地图 / 认证缺陷（通用）

认证缺陷（通用）

Improper Authentication - Generic · 身份认证

身份认证 / 认证缺陷（通用）

790公开报告

—CWE 编号

0已标注发现方式

790关联报告

发现方式分布

暂无发现方式标注。

关联报告

Improper Authentication - any user can login as other user with otp/logout & otp/loginSnapchat · 2021-09-03 · 高危 · 972 票 Bypassing Digits origin validation which leads to account takeoverX / xAI · 2020-06-24 · 未评级 · 619 票 Flickr Account Takeover using AWS Cognito APIFlickr · 2021-12-18 · 高危 · 440 票 Chained Bugs to Leak Victim's Uber's FB Oauth TokenUber · 2019-01-25 · 中危 · 427 票 [cs.money] Open Redirect Leads to Account TakeoverCS Money · 2020-09-30 · 低危 · 357 票 OTP token bypass in accessing user settingsRazer · — · 未评级 · $1,000 · 339 票 Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical)Uber · 2016-07-14 · 未评级 · 312 票 2FA bypass by sending blank codeGlassdoor · — · 未评级 · 303 票 Bypass Password Authentication for updating email and phone number - Security VulnerabilityX / xAI · 2020-02-08 · 中危 · 288 票 Insufficient OAuth callback validation which leads to Periscope account takeoverX / xAI · 2019-04-10 · 未评级 · 277 票 Insufficient validation on Digits bridgeX / xAI · 2020-08-20 · 未评级 · 263 票 Ability to DOS any organization's SSO and open up the door to account takeoversSuperhuman (formerly Grammarly) · 2021-04-15 · 中危 · $10,500 · 260 票 Improper Validation at Partners LoginEternal · 2021-10-06 · 高危 · $2,000 · 251 票 Incorrect authorization to the intelbot service leading to ticket informationTikTok · 2022-02-23 · 高危 · $15,000 · 219 票 Account Takeover via Email ID Change and Forgot Password FunctionalityNew Relic · — · 未评级 · $2,048 · 214 票 HackerOne Jira integration plugin Leaked JWT to unauthorized jira usersHackerOne · 2021-04-01 · 低危 · $3,000 · 213 票 2FA Bypass leads to impersonation of legimate usersDrugs.com · 2025-03-14 · 中危 · 207 票 H1514 [*.(my)shopify.com] - Viewing Password Protected ContentShopify · 2019-05-22 · 高危 · $3,000 · 192 票 Authentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.comUber · 2017-07-13 · 高危 · 183 票 Web Authentication Endpoint Credentials Brute-Force VulnerabilityHackerOne · 2016-06-23 · 未评级 · 161 票 Absence of Token expiry leads to Unauthorized login AccessAffirm · 2020-12-01 · 高危 · 155 票 Open Redirect on central.uber.com allows for account takeoverUber · 2019-01-25 · 中危 · 144 票 Attacker can obtain write access to any federated share/public linkNextcloud · 2021-06-10 · 中危 · $4,000 · 142 票 Reading Emails in Uber SubdomainsUber · 2016-09-14 · 未评级 · 141 票 Mint Oauth2 access token for targeted userGitLab · 2025-07-23 · 中危 · $5,580 · 140 票 Yet Another OTP code Leaked in the API ResponseMTN Group · 2025-01-08 · 高危 · 135 票 Improper bot-authentication allows to impersonate any user when sending messages in a roomBasecamp · 2025-11-21 · 中危 · $2,000 · 128 票 vulnerabilitiePornhub · — · 未评级 · 127 票 Incorrect param parsing in Digits web authenticationX / xAI · 2018-08-18 · 未评级 · 126 票 User can upload files even after closing his accountBasecamp · 2021-03-29 · 未评级 · 124 票 Critical full compromise of jarvis-new.urbanclap.com via weak session signingUrban Company · 2022-01-30 · 高危 · $1,500 · 123 票 [CRITICAL] Full account takeover without user interaction on sign with Apple flowGlassdoor · — · 未评级 · 118 票 Able to steal bearer token from deep linkBasecamp · 2022-03-27 · 中危 · $6,337 · 110 票 Ability to join an arbitrary workspace by utilizing a proxy to manipulate invite linksSlack · 2023-06-23 · 高危 · 109 票 Bypassing Digits web authentication's host validation with HPPX / xAI · 2016-08-12 · 未评级 · 108 票 Admin Authentication Bypass Lead to Admin Account TakeoverUPS VDP · 2022-06-20 · 低危 · 106 票 Staging Rabbitmq instance is exposed to the internet with default credentialsUnikrn · 2019-12-09 · 低危 · 105 票 Getting SmartDNS for free from - join.nordvpn.comNord Security · — · 未评级 · 104 票 Leak ██████████ information in real time through API requestGrab · 2018-02-03 · 中危 · $3,000 · 103 票 Login to any account with the emailaddressEternal · 2017-08-17 · 中危 · $1,000 · 103 票 PIN bypass in PassCodeActivity via back buttonNextcloud · 2026-06-07 · 低危 · $150 · 101 票 Email OTP/2FA BypassDrugs.com · 2024-06-16 · 高危 · 100 票 password reset token leaking allowed for ATO of an Uber accountUber · 2017-05-17 · 高危 · $10,000 · 100 票 No Rate Limit On Forgot Password Page Of NordVPNNord Security · — · 未评级 · 99 票 Attacker can get vine repost user all informations even Ip address and location .X / xAI · 2017-03-25 · 未评级 · 95 票 returnUrl= allow attacker to redirect users to the another phising website and takeover credientialsInsightly · 2025-06-04 · 低危 · 94 票 Account Takeover via SMS Authentication FlowZenly · 2022-01-12 · 中危 · 94 票 POST /api/bitcoinWithdrawalFees returns financial data without authentication despite being documented as a USER OPERATION (private endpoint)CoinMate.io · 2026-05-20 · 低危 · 93 票 Account takeover w/o interaction for a user that doesn't have 2fa enabled via 2fa linking and improper auth at /api/2fa/verifyHelium · 2020-07-26 · 低危 · 92 票 Unauthenticated Docker registryImgur · 2016-11-22 · 未评级 · 92 票 Bypassing Digits bridge origin validationX / xAI · 2017-04-30 · 未评级 · 92 票 Full Admin Takeover of R3 Limited's JFrog Artifactory - 292 Users, Corda Enterprise & CBDC Supply Chain CompromisedR3 · 2026-10-08 · 高危 · 91 票 Bypass of biometrics security functionality is possible in Android application (com.shopify.mobile)Shopify · 2019-08-14 · 低危 · $500 · 90 票 [CRITICAL] -- Complete Account TakeoverUber · 2016-08-15 · 未评级 · $8,000 · 89 票 Many Slack teams can be joined by abusing an improperly configured support@ inboxSlack · 2017-10-21 · 未评级 · 88 票 SAML Authentication Bypass on uchat.uberinternal.comUber · 2017-09-05 · 中危 · $8,500 · 88 票 Password Reset Link not expiring after changing the email Leads To Account TakeoverImgur · 2019-12-03 · 低危 · 87 票 PIN 📌 BYPASS 🥷Yoti · 2022-03-18 · 中危 · 84 票 [Studio.twitter.com] See someone else picsX / xAI · 2017-06-22 · 未评级 · 84 票 Access to internal CMS containing private DataYelp · 2016-10-07 · 未评级 · 83 票 “email” MFA mode allows bypassing MFA from victim’s device when the device trust is not expiredSuperhuman (formerly Grammarly) · 2019-08-12 · 低危 · $2,500 · 82 票 Unauthorized access to GovSlackSlack · 2023-05-19 · 低危 · $1,500 · 81 票 Account takeover via Google OneTapPriceline · 2022-05-11 · 中危 · 81 票 Forced OAuth authorization using button ID in hash and holding spaceLinkedIn · 2024-12-17 · 低危 · 79 票 Improper Authentication Allows Making Appeals as Other UsersU.S. Dept Of Defense · 2025-02-12 · 低危 · 77 票 default credentials at https://52.42.105.71/Trellix · 2024-02-01 · 高危 · 77 票 Login to any user account using other facebook app access tokenImgur · 2017-07-24 · 未评级 · 76 票 Open s3 bucket allows for public uploadAugur · — · 未评级 · $100 · 73 票 bypass parental pin succesfullyShowmax · — · 未评级 · $200 · 72 票 Full account takeover of any user through reset passwordU.S. Dept Of Defense · 2023-11-17 · 低危 · 71 票 Stealing livechat token and using it to chat as the user - user information disclosureShopify · 2016-07-19 · 未评级 · 71 票 Parameter Manipulation allowed for viewing of other user’s teavana.com ordersStarbucks · 2017-01-13 · 未评级 · 71 票 Email Verification Bypass via Race ConditionMalwarebytes · 2025-08-15 · 低危 · 70 票 [oauth token leak] at oauth.semrush.comSemrush · 2018-04-17 · 中危 · 70 票 Twitter SSO allows unverified e-mail registration, leads to Slack and social media hijacksZendesk · — · 未评级 · 70 票 access to profile & reset password page without authenticationTennessee Valley Authority · 2023-11-30 · 低危 · 68 票 Bypass validation parts in AWS IAM Authenticator for KubernetesKubernetes · 2023-05-25 · 中危 · $2,500 · 68 票 Subdomain Takeover Via unclaimed Heroku Instance tim-exclusive.shopify.comShopify · 2021-02-24 · 未评级 · $500 · 68 票 Authorization bypass using login by phone option+horizontal escalation possible on Grab Android AppGrab · 2017-09-14 · 中危 · 68 票 Eavesdropping on private Slack callsSlack · 2017-02-08 · 中危 · $1,000 · 68 票 Bypassing the victim's phone number OTP in the account recovery process on the https://hackerone.com/settings/auth/setup_account_recoveryHackerOne · 2024-07-11 · 高危 · 67 票 Improper Authentication (Login without Registration with any user) at ████U.S. Dept Of Defense · 2024-03-22 · 中危 · 67 票 email verification bypassAlgolia · 2021-02-18 · 低危 · 67 票 Broken Authentication - Security token gets captured via man in the middle attackAutomattic · 2019-06-22 · 中危 · 67 票 Username Validation BypassRevive Adserver · 2025-11-26 · 低危 · 64 票 Improper Authentication in Vimeo's API 'versions' endpoint.Vimeo · 2018-05-15 · 中危 · 64 票 User able to access company details in yrityspalvelu without proper permissionsLocalTapiola · — · 未评级 · $2,000 · 63 票 Subdomain Takeover Via via Dangling NS records on Amazon Route 53 http://api.e2e-kops-aws-canary.test-cncf-aws.canary.k8s.ioKubernetes · 2020-11-29 · 低危 · $250 · 62 票 Unauthenticated access to Zendesk tickets through athena-flex-production.shopifycloud.com Okta bypassShopify · 2018-09-19 · 高危 · 61 票 Access to some Slack workspace metadata and settings available to unauthorized partiesSlack · 2020-11-10 · 未评级 · $7,000 · 60 票 Bypass Password Authentication to Update the PasswordX / xAI · 2021-01-11 · 中危 · 59 票 Vulnerability Report: NO RATE LIMIT Password RESETTrellix · 2024-02-02 · 低危 · 59 票 Authentication & Registration Bypass in Newspack Extended AccessAutomattic · 2024-07-05 · 低危 · 58 票 Authentication Bypass on https://███████/U.S. Dept Of Defense · 2024-07-19 · 低危 · 58 票 Firebase Database Takeover in Zego Sense Android appZego · 2021-06-23 · 中危 · 58 票 [idor] Unauthorized Read access to all the private posts(Including Photos,Videos,Gifs)Pornhub · — · 未评级 · $1,500 · 58 票 OneLogin authentication bypass on WordPress sitesUber · 2016-06-06 · 未评级 · $10,000 · 58 票 account takeover through password reset in url https://reklama.tochka.com/QIWI · — · 未评级 · 57 票 Login Bypass to OTP EnumerationGenasys Technologies · — · 未评级 · 57 票 Open AWS S3 bucket leaks all Images uploaded to Zomato chatEternal · 2019-05-01 · 低危 · 57 票

查看全部 790 份报告 →