Skip to content
OpenAdvisories

Weakness (CWE)

CWE-290: Authentication Bypass by Spoofing

Base Incomplete

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Source: MITRE CWE-290

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-102764 Exploited Public exploit EPSS 78%

    Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support

    The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations…

    BeyondTrust Remote Support
    KEV Oct 16, 2026
  • High 8.6
    CVE-2026-104935 Exploited Public exploit EPSS 89%

    Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute ar…

    ivanti Connect Secure Network devices
    KEV Oct 13, 2026
  • Critical 10.0
    CVE-2024-54085 Exploited Public exploit EPSS 61%

    Redfish Authentication Bypass

    AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.

    AMI MegaRAC-SPx
    KEV Jun 25, 2025
  • Critical 9.8
    CVE-2024-4358 Exploited Public exploit EPSS 97%

    Registration Authentication Bypass Vulnerability

    In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

    Progress Software Telerik Report Server
    KEV Jun 13, 2024
  • Critical 9.8
    CVE-2022-24112 Exploited Public exploit EPSS 96%

    apisix/batch-requests plugin allows overwriting the X-REAL-IP header

    An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of A…

    Apache Software Foundation Apache APISIX
    KEV Aug 25, 2022
  • Critical 9.1
    CVE-2022-23131 Exploited Public exploit EPSS 96%

    Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML

    In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to esca…

    Zabbix Frontend
    KEV Feb 22, 2022