CWE-303

120 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 2 of them as exploited in the wild.

Critical 32High 43Medium 41Low 3Not scored 1

CVEs per yearBy the year they were published

CVE-2024-7593
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass…
Ivanti · vTM
ExploitedCritical9.8
CVE-2023-29357
Microsoft SharePoint Server Elevation of Privilege Vulnerability
Microsoft · Microsoft SharePoint Server 2019
ExploitedCritical9.8

CVE-2026-109928
Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account Takeover
Apache Software Foundation · Apache OFBiz
Not scored
CVE-2026-84296
SSH Multi-Factor Authentication Bypass in Progress WS_FTP Server
Progress Software · WS_FTP Server
Medium6.8
CVE-2026-86589
Apache Answer: User Center integration does not revoke first-login sessions after central account suspension
Apache Software Foundation · Apache Answer
Medium5.4
CVE-2026-89077
MOVEit Transfer Identity validation flaw in SFTP authentication
Progress · MOVEit Transfer
High7.5
CVE-2026-104939
NGINX Ingress Controller vulnerability
F5 · NGINX Ingress Controller
High8.7
CVE-2026-83906
Windows Shell Spoofing Vulnerability
Microsoft · Windows 11 version 23H2
Medium6.5
CVE-2026-85972
Improper Kerberos server verification in Progress MarkLogic Server
Progress Software Corporation · MarkLogic Server
High7.4
CVE-2026-107279
AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int
AsyncHttpClient · async-http-client
High8.8
CVE-2026-97720
Apache Impala: Impala Executor Webserver Auth Bypass
Apache Software Foundation · Apache Impala
Critical9.1
CVE-2026-92873
Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog…
Pgpool Global Development Group · Pgpool-II
Medium6.9