CWE-302

47 published CVEs are weaknesses of this kind, as the records or NVD name it.

Critical 11High 19Medium 15Low 1Not scored 1

CVEs per yearBy the year they were published

CVE-2026-114277
Apache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local Accounts
Apache Software Foundation · Apache OFBiz
Not scored
CVE-2026-80092
Microsoft Identity Web Elevation of Privilege Vulnerability
Microsoft · microsoft-identity-web
Medium5.3
CVE-2026-84731
Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS
Nutanix · Acropolis Operating System (AOS)
Critical9.3
CVE-2026-61682
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
kcp-dev · kcp
Critical9.9
CVE-2026-77508
Weblate: Unverified REST API email changes
WeblateOrg · weblate
Low3.5
CVE-2026-13267
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
IBM · Security Verify Access
High8.1
CVE-2026-5423
Subscription Authentication Bypass via Unverified connectionParams.jwt
neo4j · graphql
High8.2
CVE-2026-50528
.NET Security Feature Bypass Vulnerability
Microsoft · .NET 10.0 runtime
High8.2
CVE-2026-47303
ASP.NET Core Elevation of Privilege Vulnerability
Microsoft · .NET 10.0 runtime
High8.8
CVE-2026-48117
DroneAware's Improper Account Activation in Registration and SSO Flows Leads to Account Takeover
fduflyer · DroneAware-Node-Releases
Medium6.8