CWE-290: Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- unknown payment gateway for idramPayment Gateway for Idram < 2.1.6 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret5.3 Medium
- giuseppe99barchetta suggestarrSuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing9.1 Critical
- wimoor-erp wimoorWIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header9.1 Critical
- joey-zhou xiaozhi-esp32-server-javaXiaozhi-esp32-server-java through 6.1.0 Authentication Bypass via OTA Endpoint Token Issuance6.3 Medium
- beyondtrust remote supportImproper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support9.3 Critical
- authlib joserfcjoserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json9.1 Critical
- nutanix acropolis operating system (aos)Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS9.3 Critical
- eclipse foundation connected services platformIn `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver...7.5 High
- error311 fileriseFileRise OIDC login can bind an attacker identity to an existing local account8.1 High
- error311 fileriseFileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypass8.1 High
- holaboss-ai holaosholaOS through 2026.822.1 Authorization Bypass via Telegram Connector Username Allowlist6.3 Medium
- eclipse foundation threadx netx duoMissing HelloVerifyRequest cookie validation in the NetX Secure DTLS server6.9 Medium
- f5 nginx gateway fabricNGINX Gateway Fabric vulnerability7.1 High
- f5 nginx ingress controllerNGINX Ingress Controller vulnerability8.7 High
- openvpnOpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a...7.6 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +17 more +19 moreActive Directory Federation Services (AD FS) Spoofing Vulnerability7.5 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows Schannel Spoofing Vulnerability9.0 Critical
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 23h2 +14 more +16 moreWindows Internet (wininet.dll) Spoofing Vulnerability8.4 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWindows NTFS Information Disclosure Vulnerability5.5 Medium
- elastic endpoint security, opentext endpoint forensics & response, endpoint investigator +1 more +3 moreRemote Code Execution (RCE) vulnerability identified in the OpenText™ EnCase SAFE Agents9.3 Critical
- ivanti connect secureAuthentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated...8.6 High
- microsoft visual studio 2022 version 17.14, visual studio 2026 version 18.10, microsoft.aspnetcore.authentication.negotiate +2 moreASP.NET Core Elevation of Privilege Vulnerability7.5 High
- elated-themes frappeFrappe before 13.32.0 Weak Authentication via Print View Key8.2 High
- otrs ag ((otrs)) community edition, otrs gmbh (former otrs ag) otrs +1 moreAuthentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication9.4 Critical
- go-vikunja vikunjaVikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover7.5 High
pyload-ngPyPIpyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header6.9 Medium- liquid web / stellarwp givewpWordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability7.5 High
- wpmu dev forminatorWordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerability7.5 High
- cisa malcolmAuthentication Bypass by Spoofing in Malcolm6.5 Medium
- jacamar ci ciAuthentication Bypass by Spoofing in Jacamar CI7.5 High
- frappe technologies technologiesAuthentication bypass in multiple products from Frappe Technologies6.9 Medium
- brocade fabric os, broadcom fabric operating system +1 moreAn authentication bypass and command injection vulnerability exists in the inter-switch remote...7.1 High
- brocade fabric os, broadcom fabric operating system +1 moreAn authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST...5.1 Medium
- brocade fabric os, broadcom fabric operating system +1 moreAn authentication and access control bypass vulnerability exists in the web server management...5.3 Medium
- ovhcloudAuthenticated SMTP Sender Address Forgery6.3 Medium
- apache software foundation yunikornApache YuniKorn: Admission control bypass via system label forgery4.8 Medium
- arista networks cloudvision cueSecurity Advisory 01908.7 High
- payloadcms payloadPayload authentication token field handling issue9.2 Critical
- ben marshall zero spamWordPress Zero Spam plugin <= 5.7.11 - Bypass vulnerability vulnerability5.3 Medium
- webfactory login lockdownWordPress Login Lockdown plugin <= 2.17 - Bypass Vulnerability vulnerability4.8 Medium
- bestwebsoft captcha by bestwebsoftWordPress Captcha by BestWebSoft plugin <= 5.2.8 - Bypass Vulnerability vulnerability5.3 Medium
- daev.tech wp migration plugin db & files – wp synchro, wp synchro migration plugin db & files – wp synchro +1 moreWordPress WP Migration Plugin DB & Files – WP Synchro plugin <= 1.16.1 - 2FA Bypass vulnerability7.5 High
- langflow-ai langflowLangflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write7.1 High
- makeplane planePlane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)9.1 Critical
- @insumermodel mppx-condition-gate, mppx-token-gate +1 moremppx-condition-gate: Free-access path grants on a self-declared wallet without proving control7.5 High
- perforce p4 (helix core)Ticket host-binding bypass via spoofed client IP in P4Search5.3 Medium
- zitadelZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback9.3 Critical
- red hat certificate system 10, certificate system 11, certificate system 9 +5 more +7 morePki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject8.1 High
- processone ejabberdUser Impersonation/Authorization Bypass in XMPP Server ejabberd7.4 High
- yeswikiYesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing8.8 High
- Show moreLoading…