CWE-290: Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- rapid7 velociraptorVelociraptor OIDC Authenticator susceptible to email spoofing7.3 High
- rapid7 velociraptorVelociraptor authenticated identity-spoofing vulnerability9.6 Critical
- axis communications ab osThe Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can...5.9 Medium
- red hat openshift ai (rhoai), openshift ai 3.4 +1 moreMaas-billing: maas api: privilege escalation via forged http headers due to missing authentication9.9 Critical
- statamic cmsStatamic: Account takeover via OAuth email matching without email-verification check8.1 High
- hamid alinia login with phone numberWordPress Login with phone number plugin <= 1.8.70 - Bypass vulnerability vulnerability8.1 High
- bdthemes element pack elementor addonsWordPress Element Pack Elementor Addons plugin <= 8.7.13 - Captcha Bypass vulnerability5.3 Medium
- unknown captcha 4wpWordPress CAPTCHA 4WP plugin <= 7.6.0 - Captcha Bypass vulnerability5.3 Medium
- unknown yop poll, yop poll +1 moreYOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofing5.3 Medium
- apache jspwikiApache JSPWiki: UserManager does not sanity-check user database at startup9.8 Critical
- unknown wp travel, wp travel travel +1 moreWP Travel < 11.8.1 - Unauthenticated Payment Bypass via Forged PayPal IPN5.3 Medium
- unknown wp ghost (hide my wp ghost)Hide My WP Ghost < 7.0.05 - IP Address Spoofing via Trusted Proxy Headers Leading to Protection Mechanism Bypass5.4 Medium
- azukaar cosmos-serverCosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server6.1 Medium
- apple macosA file quarantine bypass was addressed with additional checks. This issue is fixed in macOS...5.5 Medium
- apple macosThe issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS...5.5 Medium
- zenml-io zenml-io/zenmlRate-limit Bypass in zenml-io/zenml6.5 Medium
- regularlabs.com geoip extension for joomlaJoomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension6.5 Medium
- regularlabs.com ip login extension for joomlaJoomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension7.5 High
- regularlabs.com advanced module manager extension for joomla, conditional content extension for joomla, content templater pro extension for joomla +1 more +3 moreJoomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager7.5 High
- nlnet labs unboundDNS Cookie bypass when combined with proxy-protocol use3.7 Low
- oracle security serviceVulnerability in the Oracle Security Service product of Oracle Fusion Middleware (component:...6.4 Medium
- mozilla firefox, firefox mobile +1 moreSpoofing issue in Firefox for Android7.4 High
- zohocorp manageengine adselfservice plusMulti Factor Auth Bypass7.1 High
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +2 more +4 moreKronosnet: kronosnet: access control list bypass via link id spoofing on unencrypted dynamic links4.8 Medium
- No product listedAn issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive...9.8 Critical
- astrbotdevs astrbotAstrBotDevs AstrBot API open_api.py OpenApiRoute.chat_send authentication spoofing5.3 Medium
- openclaw msteamsOpenClaw MS Teams < 2026.5.12 Authorization Bypass2.3 Low
- wekanWekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)9.8 Critical
- bulwarkmail webmailIn Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube...6.4 Medium
- ueberauth appleMissing ID token claim validation in ueberauth_apple allows account takeover9.1 Critical
- hedgedocHedgeDoc: Rate-limit bypass via CF-Connecting-IP header spoofing6.9 Medium
- mervinpraison praisonaiPraisonAI AgentMail before 4.6.78 Message Injection via Webhook6.9 Medium
- decolua 9router9router: Reverse proxy locality collapse allows unauthenticated access to 9router /v1 APIs8.3 High
- decolua 9router9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF8.2 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)8.0 High
- progress moveit transferIPv6 Loopback Spoof via Trusted Host Header Bypasses Origin Check in MOVEit Transfer3.7 Low
- decolua 9router9router: Login brute-force protection bypass via spoofed X-Forwarded-For header7.3 High
- traefikTraefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth7.8 High
- apache iotdbApache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC9.1 Critical
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability6.5 Medium
- decolua 9router9Router: Local-Only Access Gate Bypass in 9router via Host Header SpoofING7.5 High
- gofiber fiberFiber: X-Real-IP Spoofing via Header.Add() in BalancerForward5.3 Medium
- google chromeIncorrect security UI in WebAppInstalls in Google Chrome prior to 150.0.7871.46 allowed a remote...6.5 Medium
- nodebbNodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User8.7 High
- nvidia aistore frameworkNVIDIA AIStore framework contains a vulnerability where an attacker could bypass authentication....9.8 Critical
- google chromeInsufficient data validation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in MediaCapture in Google Chrome prior to 150.0.7871.47 allowed a...6.5 Medium
- google chromeIncorrect security UI in TabStrip in Google Chrome prior to 150.0.7871.47 allowed a remote...4.3 Medium
- frangoteam fuxa scada/hmiFrangoteam FUXA SCADA/HMI Authentication Bypass by Spoofing8.7 High
- woodpecker-ci woodpeckerWoodpecker < 3.15.0 - GitLab Approval Gate Bypass via Spoofable Commit Author Name9.2 Critical
- Show moreLoading…