CWE-290: Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- traefikTraefik: ForwardAuth identity spoofing via dot-form header alias5.3 Medium
- traefikTraefik before v2.11.56 Identity Spoofing via Header Alias5.3 Medium
- ncarlier webhookdwebhookd: Unrestricted HTTP Header to Shell Variable Injection6.5 Medium
- softish c6 ear camera, earvision android application +1 moreSoftish C6 Ear Camera and EarVision Android Application Authentication bypass by spoofing8.4 High
- ip2location country blockerIP2Location Country Blocker < 2.45.0 Access Control Bypass via X-Real-IP Header6.9 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows Netlogon Spoofing Vulnerability7.5 High
- commvault, commvault cloud +1 moreCommand Center API Authentication Bypass9.3 Critical
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack...9.8 Critical
- prestashopIncorrect access control in PrestaShop6.9 Medium
- getgrav grav-plugin-apiGrav API Plugin before 1.0.20 Authentication Bypass via Host Header8.7 High
- themoos core-moosMOOS core-moos through 10.4.0 MOOSDB Message Source Spoofing via Wire Identity8.8 High
- wp manage ninja fluentbooking proWordPress FluentBooking Pro plugin <= 2.2.1 - Bypass Vulnerability vulnerability5.9 Medium
- bright plugins pre-orders for woocommerceWordPress Pre-Orders for WooCommerce plugin <= 2.3 - Bypass Vulnerability vulnerability6.5 Medium
- eclipse foundation arrowheadIn Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the...9.5 Critical
- hickory-dnsHickory-DNS 0.26.0 before 0.26.2 DNSSEC Nonexistence Forgery via Wraparound NSEC8.9 High
- hickory-dnsHickory-DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Nonexistence Proof Forgery via NSEC38.7 High
- delinea secret server (on-prem)Delinea Secret Server FIDO2 credential registration authentication bypass vulnerability9.8 Critical
- grafana, grafana enterprise, oss +2 moreSession takeover via Auth Proxy cache key collision7.1 High
- wwbn avideoWWBN AVideo Authentication Bypass via User-Agent Header9.3 Critical
- wwbn avideoWWBN AVideo Authentication Bypass via X-Real-IP Header8.7 High
- arubanetworks fabric composerImproper Client Address Validation allows Request Attribution Spoofing in Fabric Composer API Endpoint4.3 Medium
- dell powerstore 1000t, powerstore 1200t, powerstore 3000t +10 more +12 moreDell PowerStore contains an Authentication Bypass by Spoofing vulnerability. An authenticated...8.8 High
- siteground securityWordPress SiteGround Security plugin <= 1.6.6 - 2FA Bypass vulnerability8.1 High
- zephyrproject zephyrWireGuard keepalive transport-data messages accepted without Poly1305 authentication3.7 Low
- phpsysinfophpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers7.5 High
- wpdeveloper essential addons for elementorWordPress Essential Addons for Elementor plugin <= 6.8.0 - Bypass vulnerability vulnerability5.3 Medium
- broadcom reactor nettyReactor Netty HTTP Server may incorrectly evaluate proxy addresses5.3 Medium
- tarscloud tarswebTarsWeb through 3.0.14 Authentication Bypass via Spoofed X-Forwarded-For and uid Parameter9.3 Critical
- nlnet labs nsdBypass of BLOCKED ACL items on proxy protocol port over TCP or TLS8.2 High
- ilya-zlobintsev lactPolkit authentication bypass in LACT7.3 High
- cakephp authenticationCakePHP: Potential Authentication bypass with CookieAuthenticator9.1 Critical
- authlib joserfcjoserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)6.5 Medium
- centrifugal centrifugoCentrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends9.1 Critical
- monkeytypegame monkeytypeMonkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)7.5 High
- splunk soarAuthentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAR8.1 High
- wpeverest user registrationWordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability5.4 Medium
- openchoreoOpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)5.3 Medium
- dell system updateA potential authentication bypass vulnerability was reported in Lenovo System Update that could...7.3 High
- rsyncproject rsyncrsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header9.1 Critical
- silabs.com wiseconnectBluetooth re-pairing can use a lower security level than previous8.8 High
- silabs.com wiseconnectforced re-pairing with already bonded device8.8 High
- cyberlord92 oauth single sign on – sso (oauth client)WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authentication vulnerability9.8 Critical
- palo alto networks prisma access agentPrisma Access Agent: Local Security Inspection Bypass Vulnerability on Windows2.1 Low
- dell display and peripheral manager (ddpm windows), display and peripheral manager +1 moreDell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an...7.8 High
- dell display and peripheral manager (ddpm windows), display and peripheral manager +1 moreDell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an...7.8 High
- dell display and peripheral manager (ddpm windows), display and peripheral manager +1 moreDell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper...7.8 High
- siyuan-note siyuanSiYuan before v3.7.4 Authentication Bypass via Localhost Trust7.1 High
- kong inc. meshKong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity6.0 Medium
- No product listedCPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to certify the integrity of the...7.2 High
- quanovate tech inc. (operating as mira / mira care) mira android app, mira firmware +1 moreMira Hormone Monitor, Mira Android App Authentication bypass by spoofing8.2 High
- Show moreLoading…