cve.bz

CWE-290: Authentication Bypass by Spoofing, page 3

Filter

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

What the weakness is: CWE-290 at MITRE

Ask an AI about CWE-290

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-290: Authentication Bypass by Spoofing and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/290.html and https://cve.bz/cve/cwe/290?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.9CVE-2026-61682EPSS 0.4%

    kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* ide…

  2. 4.2CVE-2026-85511EPSS 0.3%

    A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding.

  3. 10.0CVE-2026-69843EPSS 0.9%

    Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.

  4. 8.1CVE-2026-77903EPSS 0.4%

    Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.

  5. 9.1CVE-2026-76949EPSS 0.8%

    Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own a…

  6. 9.1CVE-2026-91039EPSS 0.7%

    Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who operates one identity-provider connection of a dynamic_oidc strategy to be signed in as a local user established through a different …

  7. 9.3CVE-2026-86863EPSS 0.6%

    pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered through the WSGI/CGI environment. WebserverAuthentication.get_user() read config.WEBSE…

  8. 8.2CVE-2026-86039EPSS 0.3%

    libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRec…

  9. 9.8CVE-2026-62108EPSS 0.6%

    Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions.

  10. 3.8CVE-2026-20071EPSS 0.2%

    A vulnerability in the SSID bring-your-own-device (BYOD) onboarding workflow of Cisco ISE could allow an unauthenticated, adjacent attacker to hijack the onboarding session of&nbsp;another user and access protected 802.1X networks. &nbsp; …

  11. 10.0CVE-2026-76423EPSS 0.6%

    A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device. This vulnerability is due to the REST API web service being exposed with…

  12. 9.1CVE-2026-92395EPSS 0.3%

    @fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify request.ip and request.ips. In versions 3.0.0 through 5.1.0, a trust subnet written in IPv4-mapped IPv6…

  13. 8.7CVE-2026-40854EPSS 0.3%

    WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component. The session verification mechanism improperly validates the sessionid cookie by checking for the existence of a corresponding file …

  14. 3.8CVE-2026-89327EPSS 0.3%

    The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attributed to, allowing any board member to post comments that appear to be authored by another user, incl…

  15. 9.5CVE-2026-15640EPSS 0.3%

    Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user.

  16. 9.1CVE-2026-89022EPSS 0.5%

    BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated attackers to sign in as arbitrary users by authenticating through a different social provider sharing t…

  17. 6.5CVE-2026-59157EPSS 0.6%

    webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without htpasswd authentication forwarded all incoming HTTP headers through HTTPParamsT…

  18. 6.1CVE-2026-49446EPSS 0.3%

    Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunn…

  19. 9.1CVE-2026-90711EPSS 0.3%

    proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an…

  20. 5.9CVE-2026-73449EPSS 0.2%

    On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through …

  21. 4.4CVE-2026-65399EPSS 0.1%

    A file quarantine bypass was addressed with additional checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, watchOS 27. An archive may be ab…

  22. 5.3CVE-2026-18065EPSS 0.4%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to gain access to sensitive information through session IP binding bypass in Navigator for i.

  23. 6.3CVE-2026-88819EPSS 0.2%

    In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.

  24. 9.5CVE-2026-21391EPSS 0.6%

    An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. In certain configurations this could allow an attacker to bypass authentication c…

  25. 9.1CVE-2026-87785EPSS 0.5%

    Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can spoof another user's privileges after comple…

  26. 4.3CVE-2025-68624EPSS 0.3%

    N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and p…

  27. 7.1CVE-2026-90447EPSS 0.2%

    A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in …

  28. 6.9CVE-2026-45056EPSS 0.3%

    matrix-sdk-crypto is a no-network-IO implementation of a state machine that handles end-to-end encryption for Matrix clients. Starting in version 0.12.0 and prior to version 0.17.0, the matrix-sdk-crypto crate was missing a check for the u…

  29. 8.5CVE-2026-63427EPSS 0.2%

    An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges.

  30. 5.3CVE-2026-88011EPSS 0.4%

    Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy be…

  31. 5.6CVE-2026-66674EPSS 0.3%

    Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions.

  32. 5.3CVE-2026-88879EPSS 0.3%

    Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, X_Auth_User and X.Auth.User are treated as three distinc…

  33. 8.4CVE-2026-82563EPSS 0.2%

    An attacker could impersonate the camera and place themselves in a man-in-the-middle or device-emulation position. This permits manipulation of device status responses, observation of application requests, and potential triggering of firmw…

  34. 6.9CVE-2026-82530EPSS 0.4%

    IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers…

  35. 7.5CVE-2026-62759EPSS 0.4%

    Authentication bypass by spoofing in Windows Netlogon allows an unauthorized attacker to perform spoofing over an adjacent network.

  36. 9.3CVE-2026-77089EPSS 0.6%

    Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Command Center.

  37. 9.8CVE-2026-86478EPSS 0.6%

    In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address

  38. 6.9CVE-2026-84186EPSS 0.5%

    Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy…

  39. 8.7CVE-2026-86196EPSS 0.4%

    Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can sen…

  40. 8.8CVE-2026-85432EPSS 0.5%

    MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers…

  41. 6.5CVE-2026-84849EPSS 0.3%

    Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versions.

  42. 5.9CVE-2026-84766EPSS 0.3%

    Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions.

  43. 9.5CVE-2026-82180EPSS 0.3%

    In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFilter parses an X.509 certificate that the client sends inside the MQTT message payload (the authent…

  44. 9.8CVE-2026-19117EPSS 0.5%

    Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.

  45. 8.1CVE-2026-14199EPSS 0.3%

    Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delim…

  46. 9.3CVE-2026-84479EPSS 0.5%

    WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder()/isAVideoMobileApp() checks match HTTP_USER_AGENT against a hardcoded literal…

  47. 8.7CVE-2026-84476EPSS 0.4%

    WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit(). Attackers can rotate the header value per request to bypass lo…

  48. 4.3CVE-2026-73742EPSS 0.3%

    A vulnerability in an API endpoint of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to spoof the source address attributed to their requests. Successful exploitation could allow an attacker to caus…

  49. 8.8CVE-2026-58575EPSS 0.5%

    Dell PowerStore contains an Authentication Bypass by Spoofing vulnerability. An authenticated attacker could potentially exploit this vulnerability to escalate privileges to Administrator.

  50. 8.1CVE-2026-82228EPSS 0.4%

    Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.