CWE-290: Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- mozilla firefox, thunderbird +1 moreSpoofing issue in WebExtensions7.5 High
- mozilla firefoxSpoofing issue in the Toolbar component in Firefox for Android6.5 Medium
- red hat build of keycloak 26.2, build of keycloak 26.2.16, build of keycloak 26.4 +7 more +9 moreOrg.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover7.5 High
- mozilla firefox, thunderbird +1 moreSpoofing issue in the Form Autofill component6.5 Medium
@samanhappy/mcphubnpm@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation9.1 Critical- fleetdm fleetFleet: IP spoofing allows bypassing API rate limiting6.9 Medium
- fleetdm fleetFleet Windows MDM Azure AD JWT Authentication Bypass8.2 High
- fleetdm fleetFleet has a rate limiting bypass via untrusted client IP headers6.9 Medium
- f5 nginx open source, nginx plus, dos +4 more +6 moreNGINX ngx_quic_module vulnerability6.9 Medium
- sillytavernSillyTavern: Authentication Bypass via SSO Header Injection9.8 Critical
- cleanuparrCleanuparr: X-Forwarded-For leftmost parsing allows remote unauthenticated admin takeover when reverse-proxy mode is enabled9.8 Critical
- apple ipados, macos, ios and ipados +1 more +3 moreA file quarantine bypass was addressed with additional checks. This issue is fixed in iOS 18.7.9...7.5 High
- openclaw crabboxCrabbox < 0.9.0 Authentication Bypass via Admin Claim Injection7.7 High
- opencartOpenCart 3.0.3.8 Session Fixation via OCSESSID Cookie9.3 Critical
- remote spark (https://www.remotespark.com/) sparkviewRemote Spark SparkView RCE10.0 Critical
- open-telemetry opentelemetry-collector-contrib, opentelemetry collector contrib +1 moreazureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay8.1 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing8.2 High
- openclawOpenClaw < 2026.4.22 - Owner Context Spoofing via Bearer Token Header8.5 High
- getsentry sentrySentry: Improper authentication on SAML SSO process allows user identity linking9.1 Critical
- tenda a300 firmware, fh303/a300, fh303 firmware +2 moreTenda FH303/A300 V5.07.68_EN Cookie Session Weakness DNS Change9.3 Critical
- tenda a302, w3002r, w309r +3 more +5 moreTenda W3002R/A302/W309R V5.07.64_en Cookie Session Weakness DNS Change9.3 Critical
- tenda w308r v2, w308r firmware +1 moreTenda W308R v2 V5.07.48 Cookie Session Weakness DNS Change9.3 Critical
- amazon freertos-plus-tcpMAC Address Validation Bypass in FreeRTOS-Plus-TCP IPv4 and IPv6 Packet Processing7.1 High
- No product listedA vulnerability in B1 Free Archiver v1.5.86 allows files extracted from downloaded archives to...7.3 High
- traefik, red hat openshift dev spaces 3.28 +1 moreTraefik: Forwarded alias spoofing top pre-auth decision bypass7.8 High
- ericsson codecheckerAuthentication bypass for certain API calls9.3 Critical
- mozilla firefox, thunderbird +1 moreSpoofing issue in the DOM: Core & HTML component6.3 Medium
- cloud foundry uuaCloud Foundry UAA SAML 2.0 Signature Bypass8.6 High
- oauth2-proxyOAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set9.3 Critical
- oauth2-proxy, oauth2 proxy project proxy, red hat ceph storage 9 +2 moreOAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing9.1 Critical
- oauth2 proxy project proxy, oauth2-proxy +1 moreOAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode9.1 Critical
- 1panel-dev maxkbMaxKB: Sandbox Result Validation Bypass via Tool Output Spoofing3.1 Low
- tmds tmds.dbus, tmds.dbus.protocol +1 moreTmds.DBus: malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of service7.1 High
- lobehubLobeHub has an unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header5.0 Medium
- djangoproject djangoASGI header spoofing via underscore/hyphen conflation7.5 High
- jupyter oauthenticatorOAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claims8.8 High
- electronElectron: Service worker can spoof executeJavaScript IPC replies5.9 Medium
- openclawOpenClaw < 2026.3.28 - Client Identity Spoofing in chat.send Gateway Provenance Guard7.1 High
- hkuds nanobotZero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling8.9 High
- traefik, red hat openshift dev spaces 3.27 +1 moreTraefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField5.1 Medium
- openclawOpenClaw < 2026.3.22 - XFF Loopback Spoofing Bypass in Canvas Authentication and Rate Limiter6.3 Medium
- openclawOpenClaw < 2026.3.22 - Improper Authentication Verification in Google Chat Webhook6.0 Medium
- sonarrSonarr Authentication Bypass vulnerability8.1 High
- yansongda payWeChat Pay callback signature verification bypassed when Host header is localhost8.6 High
- joe dolson my ticketsWordPress My Tickets plugin <= 2.1.1 - Bypass Vulnerability vulnerability5.3 Medium
- wp swings subscriptions for woocommerceWordPress Subscriptions for WooCommerce plugin <= 1.8.10 - Bypass Vulnerability vulnerability7.5 High
- n2ws n2wIn N2W before 4.3.2 and 4.4.x before 4.4.1, there is potential remote code execution and account...9.8 Critical
- n2ws n2wIn N2W before 4.3.2 and 4.4.0 before 4.4.1, improper validation of API request parameters enables...9.8 Critical
- linuxfoundation nats-serverNATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers6.4 Medium
- linuxfoundation nats-serverNATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing6.4 Medium
- Show moreLoading…