CWE-592: DEPRECATED: Authentication Bypass Issues

• CVE-2026-43512

  Apache Tomcat: Digest authenticator will authenticate any unknown user

  Critical · CVSS 9.8 · EPSS 70th

  2026-05-12
• CVE-2019-3899
  Critical · CVSS 9.8 · EPSS 72th

  2019-04-22
• CVE-2014-5432
  Critical · CVSS 9.8 · EPSS 85th

  2019-03-26
• CVE-2018-14643

  smart_proxy_dynflow gem authentication bypass in Foreman remote execution feature

  Critical · CVSS 9.8 · EPSS 93th

  2018-09-21
• CVE-2018-1085
  Critical · CVSS 9.8 · EPSS 83th

  2018-06-15
• CVE-2018-10933
  Critical · CVSS 9.1 · EPSS 100th

  2018-10-17
• CVE-2017-2684
  Critical · CVSS 9.0 · EPSS 80th

  2017-02-22
• CVE-2019-14843
  High · CVSS 8.8 · EPSS 67th

  2020-01-07
• CVE-2018-10847
  High · CVSS 8.8 · EPSS 76th

  2018-07-30
• CVE-2017-2650

  Jenkins Pipeline Classpath Step plugin allowed Script Security sandbox bypass

  High · CVSS 8.5 · EPSS 66th

  2018-07-27
• CVE-2019-10201

  Improper Verification of Cryptographic Signature in keycloak

  High · CVSS 8.1 · EPSS 53th

  2019-08-14
• CVE-2024-38884
  High · CVSS 7.8 · EPSS 7th

  2024-08-02

What is CWE-592?

This weakness has been deprecated because it covered redundant concepts already described in CWE-287.

What CVEs are caused by CWE-592?

22 recorded CVEs are attributed to CWE-592, including CVE-2026-43512, CVE-2019-3899, CVE-2014-5432.

Is CWE-592 actively exploited?

22 recorded CVEs are caused by CWE-592; none are currently in CISA's KEV catalog of actively exploited flaws.

• MITRE CWE definition (CWE-592) (opens in a new tab)
• CWE-592 vulnerabilities on NVD (opens in a new tab)
• Learn: What is a CWE?

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.