CWE-290: Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- hickory-dns Hickory-DNS 0.26.0 before 0.26.2 DNSSEC Nonexistence Forgery via Wraparound NSEC 8.9 High
- hickory-dns Hickory-DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Nonexistence Proof Forgery via NSEC3 8.7 High
- hickory-dns Hickory DNS 0.26.0 before 0.26.2 Response Validation Bypass via QDCOUNT=0 6.3 Medium
- openidentityplatform openam OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions 9.3 Critical
- ibm api connect Multiple Vulnerabilities in IBM API Connect 8.3 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 9.4 Critical
- ibm api connect Multiple Vulnerabilities in IBM API Connect 8.5 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 9.8 Critical
- ibm api connect Multiple Vulnerabilities in IBM API Connect 8.5 High
- signalwire freeswitch FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY 9.1 Critical
- cendio thinlinc Cendio ThinLinc Improper Authentication via Web Access 7.7 High
- ixsystems truenas scale Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25... 8.3 High
- godotsteam GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A... 6.5 Medium
- unknown dokan: ai powered woocommerce multivendor marketplace solution Dokan < 5.3.3 - Unauthenticated Email Sender Spoofing via Store Contact Form 5.3 Medium
- shenzhen shine industrial co., ltd. vitafit VitaFit Cloud API Authentication Bypass via POST /front/login/sns/ 9.3 Critical
- gpustack GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin 9.8 Critical
- david-crty databasement Databasement before 1.10.9 Account Takeover via OIDC Email Auto-Linking 9.2 Critical
- sensiolabs symfony Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063) 7.7 High
- dell alienware command center (awcc) Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Authentication... 3.9 Low
- pow-auth assent Unverified Sign in with Apple callback parameter can override verified ID token claims 9.3 Critical
- tryghost activitypub ActivityPub Undo handler can unfollow or remove reposts on behalf of other accounts 5.3 Medium
- suse rancher Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster 6.3 Medium
- suse rancher Cluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespace 7.9 High
- xinnan-tech xiaozhi-esp32-server xiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID Header 6.3 Medium
- dell openmanage enterprise Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by... 7.1 High
- opnsense core OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP 5.3 Medium
- mycred WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability 4.3 Medium
- labstack echo Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration 5.3 Medium
- dell powerprotect data domain management center Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8,... 6.4 Medium
- dell powerprotect data domain management center Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8,... 9.1 Critical
- watchguard fireware os Fireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation 8.7 High
- keepnet labs cybersecurity inc. agentic ai / agentic ally Authentication Bypass with X-Agentic-Ally-Token in Keepnet Labs Agentic AI / Agentic Ally 7.5 High
- hitachi hirdb server version 10, hirdb server version 9, hirdb server version 9(32) +2 more +4 more Authentication Bypass by Spoofing Vulnerability in HiRDB 9.8 Critical
- hitachi jp1/automatic job management system 3 - manager Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3 9.8 Critical
- alexandregz twofactor gauthenticator Authentication bypass by spoofing in twofactor_gauthenticator 6.3 Medium
- apple macos A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS... 5.5 Medium
- apple macos A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS... 5.5 Medium
- apple macos A downgrade issue was addressed with additional version checks. This issue is fixed in macOS... 7.8 High
- apple macos This issue was addressed with improved validation of file attributes. This issue is fixed in... 5.5 Medium
- apple macos This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2,... 4.4 Medium
- apple macos A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS... 6.2 Medium
- wolfvision cynap pro, cynap core pro, cynap receiver, cynap pure, cynap pure mini, cynap pure pro, cynap pure (next gen), cynap bridge, cynap videobar +1 more +3 more Unauthorized Access to Internal Web Resources 6.9 Medium
- gitroomhq postiz-app Forged signed tokens let any registered user take over other users and organizations 9.9 Critical
- zimbra collaboration suite Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity 5.3 Medium
- zimbra collaboration suite Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response 5.3 Medium
- zimbra collaboration suite Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer 5.3 Medium
- cgm clininet Authentication Bypass via IP Spoofing in CGM CLININET rsyncd 8.8 High
- brainstorm force surecart WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability 9.8 Critical
- traefik Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router 7.0 High
- unknown contest gallery Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP and Forgeable Voter Identity 5.3 Medium
- Show olderLoading…