cve.bz

CWE-290: Authentication Bypass by Spoofing, page 4

Filter

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

What the weakness is: CWE-290 at MITRE

Ask an AI about CWE-290

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-290: Authentication Bypass by Spoofing and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/290.html and https://cve.bz/cve/cwe/290?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 3.7CVE-2026-13735EPSS 0.3%

    Zephyr's WireGuard implementation in subsys/net/lib/wireguard/wg_crypto.c mishandled keepalive packets. In wg_process_data_message(), any type-4 transport-data message whose payload was exactly 16 bytes (an empty plaintext plus a bare Poly…

  2. 7.5CVE-2026-55584ExploitEPSS 1.9%

    phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI_ALLOWED access-control check in read_config.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTE_ADDR. A r…

  3. 5.3CVE-2026-81777EPSS 0.4%

    Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor: from n/a through 6.8.0.

  4. 5.3CVE-2026-47845EPSS 0.3%

    In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Reactor Netty 1.3.0 …

  5. 9.3CVE-2026-80349EPSS 0.7%

    TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded …

  6. 8.2CVE-2026-19538EPSS 0.4%

    The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open.

  7. 7.3CVE-2026-75037EPSS 0.2%

    Polkit Authentication Based on UnixProcessSubject / Peer PID in LACT on Linux allows an Authentication Bypass. This issue affects LACT through 0.10.0. Fixed by commit d0478fe42c2219454e272f96b1cbd29ab37ee566.

  8. 9.1CVE-2026-77337EPSS 0.7%

    CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU …

  9. 6.5CVE-2026-75509EPSS 0.1%

    joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing a…

  10. 9.3CVE-2026-76835EPSS 0.5%

    OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/req…

  11. 9.1CVE-2026-71485EPSS 0.6%

    Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, a…

  12. 7.5CVE-2026-69183EPSS 0.5%

    Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the…

  13. 8.1CVE-2026-76356EPSS 0.6%

    In Splunk SOAR versions below 8.6.0, an unauthenticated user could spoof the source IP address in a crafted request to an Automation Broker notification endpoint and execute arbitrary code on the Splunk SOAR host. The vulnerability is poss…

  14. 5.4CVE-2026-73995EPSS 0.4%

    Subscriber Broken Authentication in User Registration <= 5.2.6 versions.

  15. 6.9CVE-2026-72816EPSS 0.3%

    go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteA…

  16. 6.9CVE-2026-72815EPSS 0.5%

    go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access c…

  17. 5.3CVE-2026-73840EPSS 0.3%

    OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhook_handler.go selected a webhook provide…

  18. 7.3CVE-2026-6387EPSS 0.2%

    A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated privileges.

  19. 9.1CVE-2026-53791EPSS 0.5%

    rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who …

  20. 8.8CVE-2026-19291EPSS 0.4%

    Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x impacted. See V3 in the BLERP paper linked below.

  21. 8.8CVE-2026-16101EPSS 0.4%

    Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below

  22. 9.8CVE-2026-28008EPSS 0.6%

    Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.

  23. 2.1CVE-2026-0292EPSS 0.2%

    An authentication bypass vulnerability in the network driver of Palo Alto Networks Prisma® Access Agent on Windows enables a local administrator to bypass security inspection, subsequently allowing them to inject and intercept arbitrary n…

  24. 7.1CVE-2026-72809EPSS 0.3%

    SiYuan versions <= v3.7.2 (patched in v3.7.4) contain an authentication bypass vulnerability in the kernel's CheckAuth function, which grants the administrator role (RoleAdministrator) to any request whose RemoteAddr is loopback (127.0.0.1…

  25. 7.8CVE-2026-59916EPSS 0.1%

    Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation o…

  26. 7.8CVE-2026-59914EPSS 0.2%

    Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading t…

  27. 7.8CVE-2026-46731EPSS 0.2%

    Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading t…

  28. 6.0CVE-2026-18677EPSS 0.6%

    In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a…

  29. 7.2CVE-2025-59319EPSS 0.7%

    CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to certify the integrity of the intended boot partition and selects the first partition index matching a hardcoded type value. A crafted Linux partition could be inserted ahead o…

  30. 8.2CVE-2026-67558EPSS 0.3%

    The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identit…

  31. 7.3CVE-2026-18639EPSS 0.4%

    When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and…

  32. 9.6CVE-2026-18972EPSS 0.4%

    An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This can lead to an account takeover attack from a user with low privileges to administrator.

  33. 5.9CVE-2026-6181EPSS 0.4%

    The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account.

  34. 9.9CVE-2026-14450EPSS 0.7%

    A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically `X-MaaS-Username` and `X-MaaS-Group`, which are trusted verbatim. This l…

  35. 8.1CVE-2026-64665EPSS 0.5%

    Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as …

  36. 8.1CVE-2026-65570EPSS 0.4%

    Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions.

  37. 5.3CVE-2026-65502EPSS 0.3%

    Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.

  38. 5.3CVE-2026-32469EPSS 0.3%

    Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.

  39. 9.3CVE-2026-48063EPSS 0.2%

    Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baileys session can be sent a malicious payload via the placeholderResendMessage and trigger a fake messages.upsert event w…

  40. 5.3CVE-2026-14840EPSS 0.4%

    The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypas…

  41. 9.8CVE-2026-28812EPSS 0.7%

    UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges. Users are recommended to upgrade to version 2.12.4 or newer which fixes this issue.

  42. 5.3CVE-2026-13143EPSS 0.3%

    The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid, allowing unauthenticated attackers to forge a notification that flips …

  43. 5.4CVE-2026-11870EPSS 0.3%

    The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headers, allowing unauthenticated attackers to spoof their IP …

  44. 5.5CVE-2026-28900EPSS 0.2%

    A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks.

  45. 5.5CVE-2026-28849EPSS 0.2%

    The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks.

  46. 6.5CVE-2026-11922EPSS 0.2%

    A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the `POST /api/v1/login` and self password-change endpoints by rotating the `X-Forwarded-For` header. The rate limiter keys requ…

  47. 6.5CVE-2026-64875EPSS 0.4%

    Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension - GeoIP lookups trusted spoofable forwarded client-IP headers, this could cause GeoIP-rule bypass.

  48. 7.5CVE-2026-64797EPSS 0.3%

    Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and pot…

  49. 7.5CVE-2026-63683EPSS 0.4%

    Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager - IP and GeoIP conditions trusted spoofable forwarded headers, allowing remote clients to bypass location-based rules.

  50. 3.7CVE-2026-54478EPSS 0.2%

    In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXY…