Weakness (CWE)
CWE-290: Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Source: MITRE CWE-290
755 results · Feed
-
Medium 6.5
Authentication Bypass by Spoofing in Malcolm
Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example /IDDASH2ARK/...) enters the location (t…
-
High 7.5
Authentication Bypass by Spoofing in Jacamar CI
Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names.
-
Medium 6.9
Authentication bypass in multiple products from Frappe Technologies
A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multiple email addresses to be accepted by manipulating the email field in the /api/method/press.api.account.signup endpoint…
-
High 7.1
An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Bro…
-
Medium 5.1
An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. The inter…
-
Medium 5.3
An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabr…
-
Medium 6.9
Blind VXLAN injection into encrypted overlay networks from cluster peer
The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams sent by user processes. Any packet sent from the host network namespace of a Linux Swarm node is encry…
-
Medium 6.3
Authenticated SMTP Sender Address Forgery
Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail servers. Due to OVH's default SPF configuration, which commonly includes include:mx.ovh.com, any authenticated user with a…
-
Medium 4.8
Apache YuniKorn: Admission control bypass via system label forgery
Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yunikorn' the checks limiting the user annotation content are not run. The label is used to identify th…
-
High 8.8
Security Advisory 0190
An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their source IP address and gain administrative session privileges on the CV-CUE backend.
-
Critical 9.2
Payload authentication token field handling issue
Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at …
-
Medium 5.3
WordPress Zero Spam plugin <= 5.7.11 - Bypass vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions.
-
Medium 4.8
WordPress Login Lockdown plugin <= 2.17 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 versions.
-
Medium 5.3
WordPress Captcha by BestWebSoft plugin <= 5.2.8 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Captcha by BestWebSoft <= 5.2.8 versions.
-
High 7.5
WordPress WP Migration Plugin DB & Files – WP Synchro plugin <= 1.16.1 - 2FA Bypass vulnerability
Subscriber Bypass Vulnerability in WP Migration Plugin DB & Files – WP Synchro <= 1.16.1 versions.
-
High 7.1
Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write
Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project_id}/install) allowe…
-
Critical 9.1
Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)
Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownershi…
-
High 7.5
mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control
mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4, the packages read a wallet address from the client-supplied credential.source, ch…
-
Medium 5.3
Ticket host-binding bypass via spoofed client IP in P4Search
Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, gaining access to P4 S…
-
Critical 9.1
ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback
ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenti…
-
High 8.1
Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject
A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST s…
-
High 8.8
xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape
An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Fl…
-
High 7.4
User Impersonation/Authorization Bypass in XMPP Server ejabberd
User Impersonation in ProcessOnes XMMP Server ejabberd <= 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid parameter in SASL-PLAIN mechanism.
-
High 8.2
YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing
YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update …
-
Medium 5.3
WordPress hCaptcha for WP plugin <= 5.3.0 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in hCaptcha for WP <= 5.3.0 versions.
-
Medium 5.6
OpenSave before 2.4.0-beta.1 Authentication Bypass via Spoofed Relay Sender
OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifiers…
-
Critical 9.8
WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability
Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.
-
Medium 5.3
WordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions.
-
Medium 4.2
WordPress All In One WP Security & Firewall plugin <= 5.4.8 - Bypass Vulnerability vulnerability
Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions.
-
Medium 4.8
Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce
Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. A…
-
High 7.3
Trusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing
A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the component Multi-Record Set Handler. The manipulation results in authentication bypass by spoofing. The attack can be exe…
-
High 7.1
Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet
A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster displa…
-
High 7.4
Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6
Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass au…
-
High 7.1
Zammad: S/MIME signature verification allows forged sender impersonation
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a cer…
-
Medium 6.8
Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery
An authorization bypass was found in the Ansible Automation Platform (AAP) gateway. The gateway API allows an authenticated administrator to create a new service key for the Controller service cluster. Because service-key creation is not restricted to the ins…
-
Medium 5.3
WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.
-
Medium 6.5
WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability
Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.
-
Medium 4.8
WordPress Captcha Code plugin <= 3.32 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.
-
Medium 5.3
Premium Packages < 7.2.1 - Unauthenticated PayPal Webhook Signature Verification Bypass
The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events agai…
-
Medium 5.3
OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary …