CWE-290: Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- zephyrproject zephyrBroken IPv6 Neighbor Discovery input validation allows spoofed RA/NS/NA acceptance in Zephyr net stack8.1 High
- go-chi chigo-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header6.9 Medium
- go-chi chigo-chi chi before 5.3.0 IP Spoofing via RealIP Middleware6.9 Medium
- filebrowserFile Browser: Authentication Bypass via Proxy Auth Header Forgery9.1 Critical
- powerdns recursorSpoofed answers can mark an authoritative non-EDNS capable5.9 Medium
- gogsGogs: Authentication Bypass via Unvalidated Reverse Proxy Headers7.7 High
- corewcfCoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation10.0 Critical
- apache apisixApache APISIX: Identity spoofing issue in APISIX opa plugin2.3 Low
- apache apisixApache APISIX: JWT Algorithm Confusion allows authentication bypass7.0 High
- antonio-castellon module-auth@acastellon/auth has an authentication bypass via spoofable headers in validateToken()8.7 High
- webminWebmin HTTP header authentication bypass9.2 Critical
- dadrus heimdallHeimdall: IP Spoofing via Unvalidated Forwarding Headers7.0 High
- woodpecker-ci woodpeckerWoodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation7.1 High
- tinyproxyTinyproxy - Stathost Detection Bypass via Host Header Manipulation8.8 High
- berriai litellm, red hat exploit intelligence, ansible automation platform 2 +1 more +3 moreLiteLLM: Authentication Bypass via Host Header Injection9.5 Critical
- caddyserver caddy, red hat hardened images +1 moreCaddy: FastCGI header normalization bypass in `forward_auth copy_headers`8.1 High
- n8nn8n: Missing Token Validation on Microsoft Agent 365 Trigger Node6.3 Medium
- openclawOpenClaw < 2026.5.3 - Mutable Display Name Binding in Zalo allowFrom Policy8.6 High
- openclawOpenClaw < 2026.5.7 - Privilege Escalation via Mutable Discord Display Names in allowFrom8.6 High
- liquid web / stellarwp event ticketsWordPress Event Tickets plugin <= 5.27.5 - Bypass Vulnerability vulnerability6.5 Medium
- magepeople inc. wptravellyWordPress WpTravelly plugin <= 2.1.7 - Bypass Vulnerability vulnerability7.5 High
- team-alembic ash authenticationOAuth2/OIDC account takeover in AshAuthentication via email-based user matching9.2 Critical
- wertheim gmbh safecontroller software for vault rooms (safe deposit locker system)IP restriction bypass in Wertheim SafeController Software allows logins from unauthorized network locations5.3 Medium
- No product listedThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization...9.8 Critical
- openclawQQBot for OpenClaw < 2026.4.29 - Authorization Bypass via QQBot Streaming Command7.4 High
- openclawOpenClaw < 2026.5.18 - Identity Header Forgery via Trusted-Proxy Configuration7.4 High
- openclawOpenClaw < 2026.5.3 - Privilege Escalation via Mutable Slack Display Names in allowFrom8.6 High
- hedef media promotion interactive media marketing inc. related marketing cloud (rmc)Authentication Bypass in Hedef Media's Related Marketing Cloud (RMC)6.5 Medium
- openclawOpenClaw < 2026.5.22 - Control UI Locality Spoofing in Device Pairing8.7 High
- openclawOpenClaw < 2026.5.7 - Privilege Escalation via Mutable Display Names in Matrix allowFrom7.7 High
- whiskeysockets baileys, @whiskeysockets/baileys +1 moreBaileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload9.3 Critical
- lenovo smart connectA potential authentication bypass was reported in Lenovo Smart Connect for Windows that could...7.3 High
- pumaPuma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections7.5 High
- nocodbNocoDB: Cross-Workspace Integration Use in Connection Test6.9 Medium
- google chromeInappropriate implementation in Payments in Google Chrome on Android prior to 149.0.7827.53...6.5 Medium
- google chromeInappropriate implementation in Payments in Google Chrome prior to 149.0.7827.53 allowed a remote...6.5 Medium
- microsoft azure horizondbAzure HorizonDB Elevation of Privilege Vulnerability10.0 Critical
- runzero platform, shopware +1 moreShopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment4.3 Medium
- doorkeeper-gem doorkeeper-openid connectDoorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secret6.3 Medium
- matrix-org matrix-rust-sdkMatrix Rust SDK: Sender-binding gaps in to-device and room-key attribution6.9 Medium
- ibm websphere application serverIBM WebSphere Application Server is affected by an identity spoofing vulnerability9.1 Critical
- aam advanced access managerWordPress Advanced Access Manager plugin <= 7.1.0 - Bypass Vulnerability vulnerability7.5 High
- freescout-help-desk freescoutFreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID Path7.5 High
- microsoft ufoMicrosoft UFO WebSocket role spoofing allows authenticated peer task hijacking8.8 High
- sensiolabs symfony, symfony security-http +1 moreSymfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay7.6 High
- sensiolabs symfonySymfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator9.1 Critical
- silabs.com simplicity sdkAn attacker is able to downgrade the security of a Bluetooth LE connection by deleting an...8.8 High
- soroush im desktop appSoroush IM Desktop App 0.17.0 Authentication Bypass via Database Injection7.0 High
- triliumnext triliumTrilium Notes: macOS TCC Bypass via Prompt Spoofing5.5 Medium
- mozilla firefox, thunderbird +1 moreSpoofing issue in the Web Speech component7.5 High
- Show moreLoading…