CWE-290: Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- pinchtabPinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Token4.8 Medium
- mozilla firefox, thunderbird +1 moreSpoofing issue in the Privacy: Anti-Tracking component6.5 Medium
- automated logic webctrl premium serverAutomated Logic WebCTRL Premium Server Authentication Bypass by Spoofing7.5 High
- h3h3 has a middleware bypass with one gadget7.4 High
- microsoft edge chromium, edge for android +1 moreMicrosoft Edge (Chromium-based) for Android Spoofing Vulnerability5.0 Medium
- voltronic power snmp web pro, gvectors wpdiscuz +1 moreVoltronic Power SNMP Web Pro 1.1 Path Traversal via upload.cgi8.7 High
- unitycatalogUnity Catalog has a JWT Issuer Validation Bypass Allows Complete User Impersonation9.1 Critical
- runzero platform, shopware, opnsense core +2 moreShopware has a potential take over of app credentials8.9 High
- go-pkgz authSupabase Auth has insecure Apple and Azure authentication with ID tokens4.8 Medium
- jetbrains hubIn JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA...6.8 Medium
- classroomioAn issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the...8.1 High
- fortinet fortiwebAn authentication bypass by spoofing vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3,...5.0 Medium
- openclawOpenClaw < 2026.2.22 - Gateway Token Disclosure via Chrome CDP Probe5.9 Medium
- openclawOpenClaw < 2026.2.21 - Authentication Bypass in HTTP Gateway Routes via Tokenless Tailscale Auth8.2 High
- openclawOpenClaw < 2026.2.26 - Node Reconnect Metadata Spoofing via Unsigned Platform Fields8.6 High
- bytebaseBytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Login9.3 Critical
- n8nn8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger6.3 Medium
- n8nn8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook Trigger6.3 Medium
- honoHono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo8.2 High
- mozilla firefox, thunderbird +1 moreSpoofing issue in the WebAuthn component in Firefox for Android9.8 Critical
- wso2 api manager, identity server +1 moreA local user can be impersonated when using federated authentication with Silent JIT Provisioning.7.7 High
- No product listedImproper session management in GCOM EPON 1GE ONU version C00R371V00B01 allows attackers to...8.1 High
- byconsole wooodt liteWordPress WooODT Lite plugin <= 2.5.2 - Payment Bypass Vulnerability vulnerability7.5 High
- openclawOpenClaw < 2026.2.14 - Identity Spoofing via Mutable Username in Telegram Allowlist Authorization6.9 Medium
clawdbotnpm,openclawnpm +1 moreOpenClaw Google Chat spoofing access with allowlist authorized mutable email principal despite sender-ID mismatch2.1 Low- openclaw, openclaw nextcloud-talk +1 moreOpenClaw Nextcloud Talk < 2026.2.6 - Allowlist Bypass via actor.name Display Name Spoofing9.3 Critical
- openclawOpenClaw 2026.1.14-1 < 2026.2.2 - Allowlist Bypass via displayName and Cross-Homeserver localpart Matching in Matrix Plugin6.3 Medium
- openclaw, openclaw voice-call +1 moreOpenClaw voice-call < 2026.2.3 - Webhook Verification Bypass via Forwarded Headers8.2 High
- mozilla firefox, firefox for ios +1 moreInterrupted page loads in new tabs could allow website spoofing under trusted domains in Firefox iOS4.3 Medium
- caidoCaido has an insufficient patch for DNS rebind leading to RCE8.1 High
- frangoteam fuxaFUXA Unauthenticated Remote Code Execution in Node-RED Integration9.5 Critical
- rustfsRustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers7.7 High
- crystal shard http-protectionCrystal Shard http-protection 0.2.0 - IP Spoofing Bypass6.9 Medium
- tp link systems inc. tl-wr841n v13, tp-link systems inc. archer c20 v5, tp-link archer ax53 firmware +2 more +4 moreLogic Vulnerability on TP-Link Archer C20, Archer AX53 and TL-WR841N v137.2 High
- openstack keystonemiddleware, red hat openshift container platform 4.17, openshift container platform 4.18 +7 more +9 moreAn issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and...9.9 Critical
- lenovo thinkplus fu100, thinkplus fu200, thinkplus tsd303 +5 more +7 moreA vulnerability was reported in ThinkPlus configuration software that could allow a local...7.3 High
- zohocorp manageengine adselfservice plusAuthentication Bypass9.1 Critical
- mozilla firefox, thunderbird +1 moreSpoofing issue in the DOM: Copy & Paste and Drag & Drop component5.4 Medium
- apache nimble, apache software foundation mynewt nimble +1 moreApache Mynewt NimBLE: Incorrect handling of SMP Security Request could lead to undesirable pairing8.1 High
- go-shiori shioriShiori is vulnerable to authentication bypass via a brute force attack6.5 Medium
- trend micro, inc. micro apex central, trendmicro apex central +1 moreA LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote...9.8 Critical
- n8nn8n's Missing Stripe-Signature Verification Allows Unauthenticated Forged Webhooks6.5 Medium
- signalk signal k server, signalk-server +1 moreSignal K Server Vulnerable to Access Request Spoofing6.3 Medium
- yealink rpsYealink RPS before 2025-06-27 allows unauthorized access to information, including AutoP URL...7.4 High
- microsoft edge chromium, edge for android +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability3.1 Low
- qnap qts, quts hero +1 moreQTS, QuTS hero8.1 High
- growatt shinelan-xAuthentication bypass on web interface9.3 Critical
- growatt shinelan-x, shine lan-x firmware +1 moreSWD Interface Open on Growatt ShineLan-X8.6 High
- devolutions serverAuthentication Bypass by Spoofing vulnerability in HYPR Server allows Identity Spoofing.This...7.1 High
- foxit pdf editor, pdf reader +1 moreFoxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via OCG. When Optional...7.5 High
- Show moreLoading…