CWE-290: Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- gtt sistema de información tributarioBypass in the authentication method of the GTT Sistema de Información Tributario application9.3 Critical
- mozilla firefox, thunderbird +1 moreSpoofing issue in the Downloads Panel component7.5 High
- 1panel-dev 1panel1Panel IP Access Control Bypass via Untrusted X-Forwarded-For Headers6.5 Medium
- 1panel-dev 1panel1Panel – CAPTCHA Bypass via Client-Controlled Flag7.5 High
- yhirose cpp-httplibcpp-httplib Untrusted HTTP Header Handling: Internal Header Shadowing (REMOTE*/LOCAL*)10.0 Critical
- colorosApplication Installation Source Verification Flaw May Lead to Risk Detection Bypass5.1 Medium
- thermofisher torrent suite softwareAn issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. One of the...7.8 High
- google chromeInappropriate implementation in Split View in Google Chrome prior to 143.0.7499.41 allowed a...4.3 Medium
- google chromeInappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a local...4.4 Medium
- google chromeInappropriate implementation in Downloads in Google Chrome on Windows prior to 143.0.7499.41...4.4 Medium
- entrust nshield 5c firmware, nshield connect xc base firmware, nshield connect xc high firmware +2 more +4 moreEntrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a...6.8 Medium
- gitlabAuthentication Bypass by Spoofing in GitLab6.5 Medium
- kde connect protocolThe KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets....4.7 Medium
- google cloud lookerLooker account compromise via punycode homograph attack9.2 Critical
- mozilla firefoxSpoofing issue in Firefox3.4 Low
- saad iqbal all in one loginWordPress All In One Login plugin <= 2.0.8 - Bypass Vulnerability vulnerability5.3 Medium
- anydeskAn issue was discovered in AnyDesk through 9.0.4. When the connection between two clients is...7.5 High
- apple ipados, macos, safari +3 more +5 moreThe issue was addressed with improved checks. This issue is fixed in iOS 26.1 and iPadOS 26.1,...4.3 Medium
- apple ipados, macos, safari +4 more +6 moreAn inconsistent user interface issue was addressed with improved state management. This issue is...4.3 Medium
- microsoft configuration manager, configuration manager 2403, configuration manager 2409 +1 more +3 moreMicrosoft Configuration Manager Spoofing Vulnerability4.8 Medium
- therefore corporation gmbh online and therefore on-premisesTherefore™ Online and Therefore™ On-Premises contains an account impersonation issue, which could potentially allow the attacker to access all the stored data8.8 High
- google chromeObject lifecycle issue in Media in Google Chrome prior to 142.0.7444.59 allowed a remote attacker...7.5 High
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreAuthentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure4.3 Medium
- reolinkReolink desktop application 8.18.12 contains a vulnerability in its local authentication...5.1 Medium
- hewlett packard enterprise (hpe) arubaos (aos)Secure Boot Bypass allows for Compromise of Hardware Root of Trust7.1 High
- kiloview ndiAPI Authentication Bypass via Header Spoofing vulnerability in Kiloview NDI N30 Products10.0 Critical
alt-design/alt-redirectPackagistAlt Redirect: Potential Authentication Bypass by Spoofing through query-string stripping logic flaw6.5 Medium- python-social-auth social-app-djangoPython Social Auth - Django has unsafe account association6.3 Medium
- akkadotnet akka.netAkka.Remote TLS did not properly implement certificate-based authentication9.3 Critical
- canonical lxdSource Container Identification Vulnerability via cmdline Spoofing in devLXD Server5.1 Medium
- google chromeInappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54...8.2 High
- coder agentapiAgentAPI exposed user chat history via a DNS rebinding attack6.5 Medium
- No product listedA security vulnerability was identified in Obsidian Scheduler's REST API 5.0.0 thru 6.3.0. If an...8.2 High
- mozilla firefox, thunderbird +1 moreSpoofing issue in the WebAuthn component in Firefox for Android6.5 Medium
- igniterealtime openfireOpenfire allows potential identity spoofing via unsafe CN parsing5.9 Medium
- silabs.com wi-sun stackMan in the middle (MitM) attack vulnerability in Wi-SUN library8.6 High
- google androidIn initPhoneSwitch of SystemSettingsFragment.java, there is a possible FRP bypass due to a logic...3.3 Low
- quest one identityOne Identity by Quest Safeguard for Privileged Passwords Appliance 7.5.1.20903 is vulnerable to...4.6 Medium
- donbermoy android corona virus tracker app for indiaThe SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest...4.2 Medium
- arista networks eosOn affected platforms running Arista EOS, maliciously formed UDP packets with source port 3503 may be accepted by EOS. UDP Port 3503 is associated with LspPing Echo Reply. This can result in unexpecte…7.5 High
github.com/hydraide/hydraideGoHydrAIDE Authentication Bypass Vulnerability10.0 Critical- 2100 technology official document management system2100 Technology｜Official Document Management System - Authentication Bypass9.3 Critical
- ibm iIBM i authentication bypass7.1 High
- No product listedAn Authentication Bypass vulnerability in Blue Access' Cobalt X1 thru 02.000.187 allows an...6.5 Medium
- dell data domain operating system, powerprotect data domain feature release, powerprotect data domain lts 2023 +1 more +3 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...9.8 Critical
- cscsw pay mobileCSC Pay Mobile App 2.19.4 (fixed in version 2.20.0) contains a vulnerability allowing users to...5.4 Medium
- oauth2-proxy, oauth2 proxy project proxy +1 moreOAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion9.1 Critical
- apple macosA downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in...9.8 Critical
- No product listedAn issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. One can bypass manager approval...7.3 High
- pyloadpyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages8.7 High
- Show moreLoading…