CWE-603: Use of Client-Side Authentication

A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.

24 tracked CVEs are classified under this weakness.

Highest-risk vulnerabilities

• CVE-2026-1363 — JNC｜IAQS and I6 - Client-Side Enforcement of Server-Side Security
• CVE-2025-12868 — CyberTutor｜New Site Server - Use of Client-Side Authentication
• CVE-2025-64119 — Nuvation Energy BMS Client-side Authentication
• CVE-2024-39375 — Use of Client-Side Authentication in TELSAT marKoni FM Transmitter
• CVE-2025-30042 — Session generation possible with certificate number only
• CVE-2025-61940 — Mirion Medical EC2 Software NMIS BioDose Use of Client-Side Authentication
• CVE-2025-62650 — The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for
• CVE-2026-71187 — Ebyte NA111-M Use of Client-Side Authentication
• CVE-2025-24517 — Use of client-side authentication issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is expl
• CVE-2026-76945 — Ebyte NE2-D11 Use of Client-Side Authentication
• CVE-2026-42098 — Authorization Bypass in Sparx Enterprise Architect
• CVE-2026-40551 — Use of Client-Side Authentication in mpGabinet
• CVE-2024-52327 — ECOVACS lawnmower and vacuum cloud service live video PIN bypass
• CVE-2025-62649 — The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for
• CVE-2026-8830 — Keycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via client-side javascript manipulation

Recently published

• CVE-2026-76945 — Ebyte NE2-D11 Use of Client-Side Authentication
• CVE-2026-71187 — Ebyte NA111-M Use of Client-Side Authentication
• CVE-2026-42098 — Authorization Bypass in Sparx Enterprise Architect
• CVE-2026-8830 — Keycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via client-side javascript manipulation
• CVE-2026-40551 — Use of Client-Side Authentication in mpGabinet
• CVE-2025-30042 — Session generation possible with certificate number only
• CVE-2026-1363 — JNC｜IAQS and I6 - Client-Side Enforcement of Server-Side Security
• CVE-2025-64119 — Nuvation Energy BMS Client-side Authentication
• CVE-2025-61940 — Mirion Medical EC2 Software NMIS BioDose Use of Client-Side Authentication
• CVE-2025-12868 — CyberTutor｜New Site Server - Use of Client-Side Authentication
• CVE-2025-62650 — The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for
• CVE-2025-62649 — The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for
• CVE-2025-24517 — Use of client-side authentication issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is expl
• CVE-2024-52327 — ECOVACS lawnmower and vacuum cloud service live video PIN bypass
• CVE-2024-39375 — Use of Client-Side Authentication in TELSAT marKoni FM Transmitter

Browse the full CVE database