Weakness (CWE)
CWE-290: Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Source: MITRE CWE-290
320 results · Clear filters · Feed
-
Medium 6.5
AgentAPI exposed user chat history via a DNS rebinding attack
AgentAPI is an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex. Versions 0.3.3 and below are susceptible to a client-side DNS rebinding attack when hosted over plain HTTP on localhost. An attacker can gain access to the /messages endpoint serve…
-
Medium 6.5
Spoofing issue in the WebAuthn component in Firefox for Android
Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 143 and Thunderbird 143.
-
Medium 5.9
Openfire allows potential identity spoofing via unsafe CN parsing
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client TLS authentication contains a vulnerability in how it extracts user identities from X.509 certificates. Instead of parsing the structured A…
-
Medium 4.0
In multiple locations, there is a possible lock screen bypass due to a logic error in the code. This could lead to loca…
-
Medium 4.6
One Identity by Quest Safeguard for Privileged Passwords Appliance 7.5.1.20903 is vulnerable to One Time Password (OTP)…
-
Medium 4.2CVE-2025-56608 Public exploit
The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in `OkHt…
-
Medium 6.5
An Authentication Bypass vulnerability in Blue Access' Cobalt X1 thru 02.000.187 allows an unauthorized attacker to log…
-
Medium 5.4CVE-2025-46018 Public exploit
CSC Pay Mobile App 2.19.4 (fixed in version 2.20.0) contains a vulnerability allowing users to bypass payment authoriza…
-
Medium 6.9CVE-2025-34065 Public exploit
AVTECH IP camera, DVR, and NVR Devices Authentication Bypass via /nobody URL Path
An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function allows unauthenticated access to any request containing "/nobody" in the URL, bypassing login controls.
-
Medium 6.9
AVTECH IP camera, DVR, and NVR Devices Authentication Bypass via .cab Path Manipulation
An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function is used to identify ".cab" requests, allowing any URL containing ".cab" to bypass authentication and access protected endpoints.
-
Medium 6.3
The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (O…
-
Medium 4.9
matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator
matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. matrix-sdk-crypto since version 0.8.0 and up to 0.11.0 does not correctly validate the sender of an encrypted event. Accordingly, a malicious homeserver operator can modify events…
-
Medium 5.4
Inappropriate implementation in Tab Strip in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform …
-
Medium 5.4
The HttpAuth plugin in pGina.Fork through 3.9.9.12 allows authentication bypass when an adversary controls DNS resoluti…
-
Medium 4.9
Dell Wyse Management Suite, versions prior to WMS 5.1 contain an Authentication Bypass by Spoofing vulnerability. A hig…
-
Medium 6.9
Auth0 Account Link Extension JWT Invalid Signature Validation
Auth0 Account Link Extension is an extension aimed to help link accounts easily. Versions 2.3.4 to 2.6.6 do not verify the signature of the provided JWT. This allows the user the ability to supply a forged token and the potential to access user information wi…
-
Medium 5.5CVE-2025-24091 Public exploit
An app could impersonate system notifications. Sensitive notifications now require restricted entitlements. This issue …
-
Medium 4.3
OctoPrint Authenticated Reverse Proxy Page Authentication Bypass
OctoPrint provides a web interface for controlling consumer 3D printers. In versions up to and including 1.10.3, OctoPrint has a vulnerability that allows an attacker to bypass the login redirect and directly access the rendered HTML of certain frontend pages…
-
Medium 4.6
Jellyfin Vulnerable to Denial of Service (DoS) via IP Spoofing
Jellyfin is an open source self hosted media server. In versions 10.9.0 to before 10.10.7, the /System/Restart endpoint provides administrators the ability to restart their Jellyfin server. This endpoint is intended to be admins-only, but it also authorizes r…
-
Medium 4.9
In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use …
-
Medium 4.3
WordPress Survey Maker plugin <= 5.1.6.3 - Bypass vulnerability
Authentication Bypass by Spoofing vulnerability in Ays Pro Survey Maker survey-maker allows Identity Spoofing.This issue affects Survey Maker: from n/a through <= 5.1.6.3.
-
Medium 4.3
WordPress Asgaros Forum plugin <= 3.0.0 - File Upload Numbers Bypass vulnerability
Authentication Bypass by Spoofing vulnerability in Asgaros Asgaros Forum asgaros-forum allows Identity Spoofing.This issue affects Asgaros Forum: from n/a through <= 3.0.0.
-
Medium 5.3CVE-2025-22223 Public exploit
Spring Security Vulnerable to Authorization Bypass via Security Annotations
Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass. You are not affected if you are not using @EnableMethodSecurity, or you do not have method security …
-
Medium 6.5CVE-2025-30144 Public exploit
Fast-JWT Improperly Validates iss Claims
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 5.0.6, the fast-jwt library does not properly validate the iss claim based on the RFC 7519. The iss (issuer) claim validation within the fast-jwt library permits an array of strings as a val…
-
Medium 6.5
On IROAD X5 devices, a Bypass of Device Pairing can occur via MAC Address Spoofing. The dashcam's pairing mechanism rel…
-
Medium 6.9
IP Spoofing in CyberArk Endpoint Privilege Manager
The application or its infrastructure allows for IP address spoofing by providing its own value in the "X-Forwarded-For" header. Thus, the action logging mechanism in the application loses accountability This issue affects CyberArk Endpoint Privilege Manager …
-
Medium 4.7
Opera Mini for Android before version 52.2 is vulnerable to an address bar spoofing attack. The vulnerability allows a …
-
Medium 6.5
A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Night Club Booking Software v1.0 allows attacker…
-
Medium 6.5
A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Cleaning Business Software v1.0 allows attackers…
-
Medium 6.5
A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Cleaning Business Software v1.0 allows attackers…
-
Medium 6.5
A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Shared Asset Booking System v1.0 allows attacker…
-
Medium 5.3
Authentication bypass by spoofing issue exists in FileMegane versions above 1.0.0.0 prior to 3.4.0.0, which may lead to…
-
Medium 5.3
Security Update for the OPC UA .NET Standard Stack
Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.
-
Medium 6.6
The device ID is based on IMEI in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and F…
-
Medium 6.5
Apache Hive: Timing Attack Against Signature in LLAP util
Use of Arrays.equals() in LlapSignerImpl in Apache Hive to compare message signatures allows attacker to forge a valid signature for an arbitrary message byte by byte. The attacker should be an authorized user of the product to perform this attack. Users are …
-
Medium 5.3
WordPress reCaptcha by BestWebSoft Plugin <= 1.78 - Captcha Bypass vulnerability
Authentication Bypass by Spoofing vulnerability in bestwebsoft Google Captcha google-captcha allows Identity Spoofing.This issue affects Google Captcha: from n/a through <= 1.78.
-
Medium 6.5
Inappropriate implementation in Payments in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convince…
-
Medium 6.5
Inappropriate implementation in Fullscreen in Google Chrome on Windows prior to 132.0.6834.83 allowed a remote attacker…
-
Medium 5.4
An IDOR vulnerability in the manage-notes.php module in PHPGurukul Online Notes Sharing Management System v1.0 allows u…
-
Medium 5.3
WordPress Secure Admin IP plugin <= 2.0 - IP Spoofing vulnerability
Authentication Bypass by Spoofing vulnerability in Michal Novák Secure Admin IP allows Functionality Bypass.This issue affects Secure Admin IP: from n/a through 2.0.