Weakness (CWE)
CWE-290: Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Source: MITRE CWE-290
255 results · Clear filters · Feed
-
High 7.1
IBM i authentication bypass
IBM i 7.3, 7.4, 7.5, and 7.6 is affected by an authenticated user obtaining elevated privileges with IBM Digital Certificate Manager for i (DCM) due to a web session hijacking vulnerability. An authenticated user without administrator privileges could exploit…
-
High 7.3
An issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. One can bypass manager approval by changing the user …
-
High 8.7
pyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages
Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages
-
High 7.5
Hijacking Caido instance during the initial setup via DNS Rebinding to achieve RCE
Caido is a web security auditing toolkit. Prior to version 0.48.0, due to the lack of protection for DNS rebinding, Caido can be loaded on an attacker-controlled domain. This allows a malicious website to hijack the authentication flow of Caido and achieve co…
-
High 8.8
Authentication bypass vulnerability in the DSoftBus module Impact: Successful exploitation of this vulnerability may af…
-
High 8.2
Dataease H2 Database Remote Code Execution (RCE) Bypass Vulnerability
DataEase is an open source business intelligence and data visualization tool. Versions prior to version 2.10.10 have a flaw in the patch for CVE-2025-32966 that allow the patch to be bypassed through case insensitivity because INIT and RUNSCRIPT are prohibite…
-
High —
Babylon Finality Provider `MsgCommitPubRandList` replay attack
### Summary A high vulnerability exists in the Babylon protocol's x/finality module due to a lack of domain separation in signed messages, combined with insufficient validation in the MsgCommitPubRandList handler. Specifically, the handler does not enforce th…
-
High 7.5
Sender Spoofing via Malformed From Header in Thunderbird
Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value "Spoofed Name ", Thunderbird treats spoofed@example.com as the actua…
-
High 8.6
passport-wsfed-saml2 Has SAML Authentication Bypass via Attribute Smuggling
passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including version 4.6.3 allows an attacker to impersonate any user during SAML authentication by tampering with a v…
-
High 7.0
An issue in Mytel Telecom Online Account System v1.0 allows attackers to bypass the OTP verification process via a craf…
-
High 8.2CVE-2025-32966 Scanner template
Dataease H2 JDBC Connection Remote Code Execution
DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.8, authenticated users can complete RCE through the backend JDBC link. This issue has been patched in version 2.10.8.
-
High 7.3
Francois Jacquet RosarioSIS v12.0.0 was discovered to contain a content spoofing vulnerability in the Theme configurati…
-
High 8.1
Whitelist bypass Vulnerability in GameCenter
There is a whitelist mechanism bypass in GameCenter ,successful exploitation of this vulnerability may affect service confidentiality and integrity.
-
High 8.4
Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability …
-
High 8.4
Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability …
-
High 8.4
Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability …
-
High 8.4
Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability …
-
High 8.4
Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability …
-
High 7.3
URL Bar Spoofing via non-BMP Unicode characters
A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This vulnerability was fixed in Firefox 137, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9.
-
High 8.1
An issue was discovered on G-Net Dashcam BB GONX devices. Bypassing of Device Pairing can occur. It uses MAC address ve…
-
High 8.6
Vela Server has Insufficient Webhook Payload Data Verification
Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a r…
-
High 7.0
Crafted email message incorrectly shown as being encrypted
Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown as being encrypted. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8.
-
High 7.3
D-Link DHP-W310AV authentication spoofing
A vulnerability has been found in D-Link DHP-W310AV 1.04 and classified as critical. This vulnerability affects unknown code. The manipulation leads to authentication bypass by spoofing. The attack can be initiated remotely. The exploit has been disclosed to …
-
High 7.5
API Security bypass through header manipulation
In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unautho…
-
High 7.1
In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration
-
High 7.5
Oqtane Framework Incorrect Access Control vulnerability
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of se…
-
High 8.7
Authentication Bypass by Spoofing in Snap One OVRC cloud
Snap One OVRC cloud uses the MAC address as an identifier to provide information when requested. An attacker can impersonate other devices by supplying enumerated MAC addresses and receive sensitive information about the device.
-
High 8.8
Unauthenticated Zabbix frontend takeover when SSO is being used
A bug in the code allows an attacker to sign a forged zbx_session cookie, which then allows them to sign in with admin permissions.
-
High 7.5
CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause a denial of service and loss of confid…
-
High 7.5
A clipboard "paste" button could persist across tabs which allowed a spoofing attack. This vulnerability affects Firefo…
-
High 7.5
Truncation of a long URL could have allowed origin spoofing in a permission prompt. This vulnerability affects Firefox …
-
High 7.5
Lack of JWT issuer and signer validation
The Amazon.ApplicationLoadBalancer.Identity.AspNetCore repo https://github.com/awslabs/aws-alb-identity-aspnetcore#validatetokensignature contains Middleware that can be used in conjunction with the Application Load Balancer (ALB) OpenId Connect integration a…
-
High 7.5
Lack of JWT issuer and signer validation
The AWS ALB Route Directive Adapter For Istio repo https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/tree/master provides an OIDC authentication mechanism that was integrated into the open source Kubeflow project. The adapter uses JWT for a…
-
High 7.5
Zendesk before 2024-07-02 allows remote attackers to read ticket history via e-mail spoofing, because Cc fields are ext…
-
High 7.5
CoreDNS vulnerable to TuDoor Attacks
An issue was discovered in CoreDNS through 1.10.1. There is a vulnerability in DNS resolving software, which triggers a resolver to ignore valid responses, thus causing denial of service for normal resolution. In an exploit, the attacker could just forge a re…
-
High 7.5
CoreDNS Cache Poisoning via a birthday attack
CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack.
-
High 8.8
An incorrectly implemented authentication scheme that is subjected to a spoofing attack in the management console of Iv…
-
High 8.1
Apache CloudStack: SAML Signature Exclusion
The CloudStack SAML authentication (disabled by default) does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an attacker that initiates CloudStack SAML single sign-on authentication can bypass SAML authentication…
-
High 8.7
PingOne MFA Integration Kit MFA bypass
PingOne MFA Integration Kit contains a vulnerability related to the Prompt Users to Set Up MFA configuration. Under certain conditions, this configuration could allow for a new MFA device to be paired with a target user account without requiring second-factor…
-
High 7.7
PingOne MFA Integration Kit MFA bypass
PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second factor authentication from the user's existing registered devices. A threat actor might be able to exploi…