Analysis

Common Weaknesses

The most common CWE weakness classes across Erlang ecosystem CVEs

The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.

Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.

Weak Authentication CWE-1390 CWE-1390 at MITRE

The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

Authentication Bypass by Spoofing: 2 CVEs (50.0%) — click to drill down Authentication Bypass by Capture-replay: 1 CVEs (25.0%) — click to drill down Use of Weak Credentials: 1 CVEs (25.0%) — click to drill down Improper Resolution of Path Equivalence: 0 CVEs (0.0%) — click to drill down Not Using Password Aging: 0 CVEs (0.0%) — click to drill down Password Aging with Long Expiration: 0 CVEs (0.0%) — click to drill down Authentication Bypass by Alternate Name: 0 CVEs (0.0%) — click to drill down Reflection Attack in an Authentication Protocol: 0 CVEs (0.0%) — click to drill down Authentication Bypass by Assumed-Immutable Data: 0 CVEs (0.0%) — click to drill down Incorrect Implementation of Authentication Algorithm: 0 CVEs (0.0%) — click to drill down Authentication Bypass by Primary Weakness: 0 CVEs (0.0%) — click to drill down Improper Restriction of Excessive Authentication Attempts: 0 CVEs (0.0%) — click to drill down Use of Single-factor Authentication: 0 CVEs (0.0%) — click to drill down Use of Password System for Primary Authentication: 0 CVEs (0.0%) — click to drill down Insufficiently Protected Credentials: 0 CVEs (0.0%) — click to drill down Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created: 0 CVEs (0.0%) — click to drill down Use of Client-Side Authentication: 0 CVEs (0.0%) — click to drill down Unverified Password Change: 0 CVEs (0.0%) — click to drill down Weak Password Recovery Mechanism for Forgotten Password: 0 CVEs (0.0%) — click to drill down Guessable CAPTCHA: 0 CVEs (0.0%) — click to drill down Use of Password Hash Instead of Password for Authentication: 0 CVEs (0.0%) — click to drill down Total 4
Authentication Bypass by Spoofing CWE-290 2 (50.0%) Authentication Bypass by Capture-replay CWE-294 1 (25.0%) Use of Weak Credentials CWE-1391 1 (25.0%) Improper Resolution of Path Equivalence CWE-41 0 (0.0%) Not Using Password Aging CWE-262 0 (0.0%) Password Aging with Long Expiration CWE-263 0 (0.0%) Authentication Bypass by Alternate Name CWE-289 0 (0.0%) Reflection Attack in an Authentication Protocol CWE-301 0 (0.0%) Authentication Bypass by Assumed-Immutable Data CWE-302 0 (0.0%) Incorrect Implementation of Authentication Algorithm CWE-303 0 (0.0%) Authentication Bypass by Primary Weakness CWE-305 0 (0.0%) Improper Restriction of Excessive Authentication Attempts CWE-307 0 (0.0%) Use of Single-factor Authentication CWE-308 0 (0.0%) Use of Password System for Primary Authentication CWE-309 0 (0.0%) Insufficiently Protected Credentials CWE-522 0 (0.0%) Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created CWE-593 0 (0.0%) Use of Client-Side Authentication CWE-603 0 (0.0%) Unverified Password Change CWE-620 0 (0.0%) Weak Password Recovery Mechanism for Forgotten Password CWE-640 0 (0.0%) Guessable CAPTCHA CWE-804 0 (0.0%) Use of Password Hash Instead of Password for Authentication CWE-836 0 (0.0%)

CVEs

CVEs for Weak Authentication CWE-1390

Summary Publication CVE ID Published
Boruta accepts expired JWT client assertions due to missing exp claim validation
pkg:hex/boruta
pkg:github/malach-it/boruta_auth
CVE-2026-53431 2026-07-30
Missing ID token claim validation in ueberauth_apple allows account takeover
pkg:hex/ueberauth_apple
pkg:github/ueberauth/ueberauth_apple
CVE-2026-55954 2026-07-14
DTLS server cookie bypass during startup window due to empty initial cookie secret
pkg:otp/ssl
pkg:github/erlang/otp
CVE-2026-54887 2026-07-02
OAuth2/OIDC account takeover in AshAuthentication via email-based user matching
pkg:hex/ash_authentication
pkg:github/team-alembic/ash_authentication
CVE-2026-49757 2026-06-15
4 CVEs