cve.bz

CWE-290: Authentication Bypass by Spoofing, page 2

Filter

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

What the weakness is: CWE-290 at MITRE

Ask an AI about CWE-290

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-290: Authentication Bypass by Spoofing and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/290.html and https://cve.bz/cve/cwe/290?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.2CVE-2023-54411EPSS 0.3%

    Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints. Attackers can generate a valid key to view documents through th…

  2. 9.4CVE-2026-93582EPSS 0.4%

    The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variable. In CGI and mod_perl based deployments, HTTP request hea…

  3. 7.5CVE-2026-62367EPSS 0.09%

    Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback` option on an OpenID Connect provider, Vikunja links an SSO login to a pre-exist…

  4. 7.5CVE-2026-96336EPSS 0.3%

    Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: from n/a through 1.57.2.

  5. 7.5CVE-2026-96333EPSS 0.3%

    Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spoofing.This issue affects GiveWP: from n/a through 4.16.8.1.

  6. 6.5CVE-2026-107336EPSS 0.2%

    Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example /IDDASH2ARK/...) en…

  7. 7.5CVE-2026-107589EPSS 0.1%

    Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names.

  8. 6.9CVE-2026-4894EPSS 0.4%

    A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multiple email addresses to be accepted by manipulating the email field in the /api/method/press.api.acc…

  9. 7.1CVE-2026-87663EPSS 0.7%

    An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing remote command execution IPC frames a…

  10. 5.3CVE-2026-87686EPSS 0.2%

    An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the cl…

  11. 5.1CVE-2026-87670EPSS 0.2%

    An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. The internal gate guarding restricted management endpoints relies exclusively on client-controlled HTTP headers. An authenticated…

  12. 6.9CVE-2026-92542EPSS 0.07%

    The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams sent by user processes. Any packet sent from the host network namespace of a Linux…

  13. 6.3CVE-2026-33586EPSS 0.1%

    Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail servers. Due to OVH's default SPF configuration, which commonly includes include:mx.ovh.com, any au…

  14. 4.8CVE-2026-97146EPSS 0.3%

    Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yunikorn' the checks limiting the user annotation content are not run. The label is…

  15. 8.7CVE-2026-102161EPSS 0.2%

    An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their source IP address and gain administrative session privileges on …

  16. 9.2CVE-2026-105863EPSS 0.4%

    Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authenticat…

  17. 4.8CVE-2026-97308EPSS 0.2%

    Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 versions.

  18. 5.3CVE-2026-39772EPSS 0.3%

    Unauthenticated Bypass Vulnerability in Captcha by BestWebSoft <= 5.2.8 versions.

  19. 5.3CVE-2026-105057EPSS 0.3%

    Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions.

  20. 7.5CVE-2026-41558EPSS 0.3%

    Subscriber Bypass Vulnerability in WP Migration Plugin DB & Files – WP Synchro <= 1.16.1 versions.

  21. 7.1CVE-2026-105741EPSS 0.2%

    Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project…

  22. 9.1CVE-2026-105640EPSS 0.4%

    Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider au…

  23. 7.5CVE-2026-104891EPSS 0.3%

    mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4, the packages read a wallet address from the client-supplied c…

  24. 5.3CVE-2026-103512EPSS 0.4%

    Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, ga…

  25. 9.3CVE-2026-105215EPSS 0.3%

    ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP …

  26. 8.1CVE-2026-104988EPSS 0.2%

    A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribu…

  27. 8.7CVE-2026-94422EPSS 0.5%

    An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicio…

  28. 7.4CVE-2026-104733EPSS 0.2%

    User Impersonation in ProcessOnes XMMP Server ejabberd <= 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid parameter in SASL-PLAIN mechanism.

  29. 8.8CVE-2026-104445EPSS 0.4%

    YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send sign…

  30. 5.3CVE-2026-103347EPSS 0.2%

    Unauthenticated Bypass Vulnerability in hCaptcha for WP <= 5.3.0 versions.

  31. 6.3CVE-2026-103397EPSS 0.2%

    OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read pai…

  32. 9.8CVE-2026-97274EPSS 0.3%

    Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.

  33. 5.3CVE-2026-97249EPSS 0.2%

    Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions.

  34. 4.2CVE-2026-96825EPSS 0.2%

    Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions.

  35. 4.8CVE-2026-92899EPSS 0.5%

    Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base6…

  36. 5.5CVE-2026-101280EPSS 0.4%

    A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the component Multi-Record Set Handler. The manipulation results in authentication bypass by spoofing. T…

  37. 7.1CVE-2026-93538EPSS 0.2%

    A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such a…

  38. 9.1CVE-2026-100390EPSS 0.3%

    Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their sou…

  39. 7.1CVE-2026-84465EPSS 0.1%

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only …

  40. 6.8CVE-2026-94416EPSS 0.5%

    An authorization bypass was found in the Ansible Automation Platform (AAP) gateway. The gateway API allows an authenticated administrator to create a new service key for the Controller service cluster. Because service-key creation is not r…

  41. 5.3CVE-2026-95524EPSS 0.3%

    Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.

  42. 6.5CVE-2026-95523EPSS 0.3%

    Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.

  43. 4.8CVE-2026-94457EPSS 0.2%

    Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.

  44. 5.3CVE-2026-93511EPSS 0.3%

    The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-can…

  45. 5.3CVE-2026-92929EPSS 0.5%

    OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to b…

  46. 6.5CVE-2026-37604EPSS 0.5%

    pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/Ip.class.php from the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without verifying the request comes from a truste…

  47. 7.4CVE-2026-55210EPSS 0.5%

    Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's UserModel.ssoLogin() returns an existing account matched by an IdP-asserted email without checking th…

  48. 4.9CVE-2026-63329EPSS 0.3%

    Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copy_server_request in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before inject_own_headers appends the…

  49. 5.8CVE-2026-62987EPSS 0.2%

    Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/http_headers.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-co…

  50. 9.8CVE-2026-85751EPSS 0.6%

    Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset trusted a client-controlled X-For…