Weakness (CWE)
CWE-290: Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Source: MITRE CWE-290
318 results · Clear filters · Feed
-
Medium 6.8
Hickory-DNS 0.26.0 before 0.26.2 DNSSEC Nonexistence Forgery via Wraparound NSEC
The DNSSEC validation in the Hickory DNS hickory-net crate 0.26.0 before 0.26.2 identifies wraparound NSEC records by comparing the next domain name to an SOA record in the response, accepting that SOA even if it fails validation. Attackers who can supply DNS…
-
Medium 6.5
GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A grant_gold(1000000) ca…
-
Medium 5.3
Dokan < 5.3.3 - Unauthenticated Email Sender Spoofing via Store Contact Form
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted site-owned sender address when relaying its store contact form, instead placing the unauthenticated submitter's supplied address directly i…
-
Medium 5.3
ActivityPub Undo handler can unfollow or remove reposts on behalf of other accounts
ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the `Undo` handler allows a remote federated server to cause the service to act on a `follow` or `repost` as though the activity came from a different accou…
-
Medium 6.3CVE-2026-104623 Public exploit
Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster
A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possible olde…
-
Medium 4.8
xiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID Header
xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an all…
-
Medium 5.4
OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP
OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on th…
-
Medium 4.3
WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability
Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through 4.0.1.
-
Medium 5.3
Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration
Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is unset, and the default RateLimiter uses that result as its client identifier. A remote attacker can r…
-
Medium 6.4
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions…
-
Medium 6.3
Authentication bypass by spoofing in twofactor_gauthenticator
The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains user's password can spoof a whi…
-
Medium 5.5
A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Golden Gate 27, macOS Sequo…
-
Medium 5.5
A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Golden Gate 27.2, macOS Tah…
-
Medium 5.5
This issue was addressed with improved validation of file attributes. This issue is fixed in macOS Golden Gate 27, macO…
-
Medium 4.4
This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An ap…
-
Medium 6.2
A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Golden Gate 27.2, macOS Seq…
-
Medium 5.3
Unauthorized Access to Internal Web Resources
An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface. The accessible resources do…
-
Medium 5.3
Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity
An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invitations attributed to another user. The email delivery path permits external invitations but does not verify that the m…
-
Medium 5.3
Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response
An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another attendee's response to an existing meeting. Zimbra passes a null sender identity when processing iC…
-
Medium 5.3
Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer
An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to cancel or modify an existing meeting in a recipient's calendar. Zimbra accepts iCalendar CANCEL and REQUEST comp…
-
Medium 5.3
Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP and Forgeable Voter Identity
The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticate…
-
Medium 5.3
Payment Gateway for Idram < 2.1.6 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret
The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticated attackers to forge a…
-
Medium 5.6
Xiaozhi-esp32-server-java through 6.1.0 Authentication Bypass via OTA Endpoint Token Issuance
Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open a victim device's WebS…
-
Medium 4.8
holaOS through 2026.822.1 Authorization Bypass via Telegram Connector Username Allowlist
holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can subm…
-
Medium 6.9
Missing HelloVerifyRequest cookie validation in the NetX Secure DTLS server
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603, the NetX Secure DTLS server never compares the cookie a client returns with the one it issued, and treats any non-empty cookie as verified. A remote attacker can make the server send its full hand…
-
Medium 6.5
NGINX Gateway Fabric vulnerability
Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A namespaced authenticated attacker with access to a service account may imper…
-
Medium 5.5
Windows NTFS Information Disclosure Vulnerability
Improper access control in Windows NTFS allows an authorized attacker to disclose information locally.
-
Medium 5.9
Frappe before 13.32.0 Weak Authentication via Print View Key
Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints. Attackers can generate a valid key to view documents through the print view without…
-
Medium —
pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header
## Summary pyLoad determines the "client IP" used for its rate-limiting decorator and for its security/audit logging by reading the client-supplied `X-Forwarded-For` (XFF) HTTP header and taking the leftmost value. No trusted-proxy configuration exists (the C…
-
Medium 6.5
Authentication Bypass by Spoofing in Malcolm
Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example /IDDASH2ARK/...) enters the location (t…
-
Medium 6.9
Authentication bypass in multiple products from Frappe Technologies
A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multiple email addresses to be accepted by manipulating the email field in the /api/method/press.api.account.signup endpoint…
-
Medium 5.1
An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. The inter…
-
Medium 5.3
An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabr…
-
Medium 6.9
Blind VXLAN injection into encrypted overlay networks from cluster peer
The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams sent by user processes. Any packet sent from the host network namespace of a Linux Swarm node is encry…
-
Medium 6.3
Authenticated SMTP Sender Address Forgery
Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail servers. Due to OVH's default SPF configuration, which commonly includes include:mx.ovh.com, any authenticated user with a…
-
Medium 4.8
Apache YuniKorn: Admission control bypass via system label forgery
Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yunikorn' the checks limiting the user annotation content are not run. The label is used to identify th…
-
Medium 5.3
WordPress Zero Spam plugin <= 5.7.11 - Bypass vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions.
-
Medium 4.8
WordPress Login Lockdown plugin <= 2.17 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 versions.
-
Medium 5.3
WordPress Captcha by BestWebSoft plugin <= 5.2.8 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Captcha by BestWebSoft <= 5.2.8 versions.
-
Medium 5.3
Ticket host-binding bypass via spoofed client IP in P4Search
Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, gaining access to P4 S…