CWE-290 · Authentication Bypass by Spoofing (page 3)
Page 3 of 7 — CVEs classified under CWE-290, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-66570 | Critical | 10.0 | 2025-12-05 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to i… |
CVE-2025-66270 | Medium | 4.7 | 2025-12-05 | The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect be… |
CVE-2025-27389 | | 2025-12-05 | A flaw exists in the verification of application installation sources within ColorOS. Under specific conditions, this issue may cause the risk detection mechan… | |
CVE-2025-54305 | High | 7.8 | 2025-12-04 | An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. One of the middlewares included in this application, LocalhostAuthMiddlew… |
CVE-2025-13636 | Medium | 4.3 | 2025-12-02 | Inappropriate implementation in Split View in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2025-13635 | Medium | 4.4 | 2025-12-02 | Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a local attacker to perform UI spoofing via a crafted HTML page. (Chr… |
CVE-2025-13634 | Medium | 4.4 | 2025-12-02 | Inappropriate implementation in Downloads in Google Chrome on Windows prior to 143.0.7499.41 allowed a local attacker to bypass mark of the web via a crafted H… |
CVE-2025-59699 | Medium | 6.8 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker to escalate privileges by booting from… |
CVE-2025-12653 | Medium | 6.5 | 2025-11-26 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that under specific c… |
CVE-2025-12414 | | 2025-11-20 | An attacker could take over a Looker account in a Looker instance configured with OIDC authentication, due to email address string normalization.Looker-hosted… | |
CVE-2025-13015 | Low | 3.4 | 2025-11-11 | Spoofing issue in Firefox. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, and Firefox ESR 115.30. |
CVE-2025-12430 | High | 7.5 | 2025-11-10 | Object lifecycle issue in Media in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium sec… |
CVE-2025-11209 | High | 8.2 | 2025-11-06 | Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker to spoof the contents of the Omnibox (URL… |
CVE-2025-27916 | High | 7.5 | 2025-11-06 | An issue was discovered in AnyDesk for Windows before 9.0.6 and AnyDesk for Android before 8.0.0. When the connection between two clients is established via an… |
CVE-2025-58595 | Medium | 5.3 | 2025-11-06 | Authentication Bypass by Spoofing vulnerability in Saad Iqbal All In One Login change-wp-admin-login allows Identity Spoofing.This issue affects All In One Log… |
CVE-2025-43503 | Medium | 4.3 | 2025-11-04 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 a… |
CVE-2025-43493 | Medium | 4.3 | 2025-11-04 | The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, vis… |
CVE-2025-59501 | Medium | 4.8 | 2025-10-31 | Authentication bypass by spoofing in Microsoft Configuration Manager allows an authorized attacker to perform spoofing over an adjacent network. |
CVE-2025-11843 | | 2025-10-31 | Therefore Corporation GmbH has recently become aware that Therefore™ Online and Therefore™ On-Premises contain an account impersonation vulnerability. A malici… | |
CVE-2025-5605 | Medium | 4.3 | 2025-10-24 | An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate… |
CVE-2025-56800 | Medium | 5.1 | 2025-10-21 | Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism. The application implements lock screen password logic entir… |
CVE-2025-37147 | High | 7.1 | 2025-10-14 | A Secure Boot Bypass Vulnerability exists in affected Access Points that allows an adversary to bypass the hardware root of trust verification in place to ensu… |
CVE-2025-9265 | | 2025-10-13 | A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state… | |
CVE-2025-60868 | Medium | 6.5 | 2025-10-10 | The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enabled. Case variations… |
CVE-2025-61778 | | 2025-10-06 | Akka.NET is a .NET port of the Akka project from the Scala / Java community. In all versions of Akka.Remote from v1.2.0 to v1.5.51, TLS could be enabled via ou… | |
CVE-2025-54288 | Medium | 6.8 | 2025-10-02 | Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any con… |
CVE-2025-59956 | Medium | 6.5 | 2025-09-30 | AgentAPI is an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex. Versions 0.3.3 and below are susceptible to a client-side DNS rebinding attack w… |
CVE-2025-56449 | High | 8.2 | 2025-09-29 | A security vulnerability was identified in Obsidian Scheduler's REST API 5.0.0 thru 6.3.0. If an account is locked out due to not enrolling in MFA (e.g. after… |
CVE-2025-10530 | Medium | 6.5 | 2025-09-16 | Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 143 and Thunderbird 143. |
CVE-2025-59154 | Medium | 5.9 | 2025-09-15 | Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client TLS authentication contains a vulnerabi… |
CVE-2025-7448 | | 2025-09-12 | Wi-SUN unexpected 4- Way Handshake packet receptions may lead to predictable keys and potentially leading to Man in the middle (MitM) attack | |
CVE-2025-26419 | Low | 3.3 | 2025-09-04 | In initPhoneSwitch of SystemSettingsFragment.java, there is a possible FRP bypass due to a logic error in the code. This could lead to local escalation of priv… |
CVE-2025-26428 | Low | 3.2 | 2025-09-04 | In startLockTaskMode of LockTaskController.java, there is a possible lock screen bypass due to a logic error in the code. This could lead to physical escalatio… |
CVE-2025-26421 | Medium | 4.0 | 2025-09-04 | In multiple locations, there is a possible lock screen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additi… |
CVE-2025-56689 | Medium | 4.6 | 2025-09-03 | One Identity by Quest Safeguard for Privileged Passwords Appliance 7.5.1.20903 is vulnerable to One Time Password (OTP)/Multifactor Authentication (MFA) bypass… |
CVE-2025-56608 | Medium | 4.2 | 2025-09-03 | The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in `OkHttpClientWrapper.java`. The `handleDigest… |
CVE-2025-6188 | High | 7.5 | 2025-08-25 | On affected platforms running Arista EOS, maliciously formed UDP packets with source port 3503 may be accepted by EOS. UDP Port 3503 is associated with LspPing… |
CVE-2025-8853 | Critical | 9.8 | 2025-08-11 | Official Document Management System developed by 2100 Technology has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to obtai… |
CVE-2025-36119 | High | 7.1 | 2025-08-08 | IBM i 7.3, 7.4, 7.5, and 7.6 is affected by an authenticated user obtaining elevated privileges with IBM Digital Certificate Manager for i (DCM) due to a web s… |
CVE-2025-50454 | Medium | 6.5 | 2025-08-05 | An Authentication Bypass vulnerability in Blue Access' Cobalt X1 thru 02.000.187 allows an unauthorized attacker to log into the application as an administrato… |
CVE-2025-36594 | Critical | 9.8 | 2025-08-04 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2024 release Versions 7.13.1.0… |
CVE-2025-46018 | Medium | 5.4 | 2025-08-01 | CSC Pay Mobile App 2.19.4 (fixed in version 2.20.0) contains a vulnerability allowing users to bypass payment authorization by disabling Bluetooth at a specifi… |
CVE-2025-54576 | Critical | 9.1 | 2025-07-30 | OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load… |
CVE-2025-43245 | Critical | 9.8 | 2025-07-30 | A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7… |
CVE-2025-31511 | High | 7.3 | 2025-07-22 | An issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. One can bypass manager approval by changing the user ID in a Request%20Building%20Access requ… |
CVE-2025-34065 | | 2025-07-01 | An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function allows unauthenticated acces… | |
CVE-2025-34063 | | 2025-07-01 | A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via th… | |
CVE-2025-34053 | | 2025-07-01 | An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function is used to identify ".cab" r… | |
CVE-2025-23168 | Medium | 6.3 | 2025-06-19 | The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via email or SMS. Versa Di… |
CVE-2025-48937 | Medium | 4.9 | 2025-06-10 | matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. matrix-sdk-crypto since version 0.8.0 and up to 0.11.0 does not correctly valid… |
CVE-2025-49004 | High | 7.5 | 2025-06-09 | Caido is a web security auditing toolkit. Prior to version 0.48.0, due to the lack of protection for DNS rebinding, Caido can be loaded on an attacker-controll… |
CVE-2025-48906 | High | 8.8 | 2025-06-06 | Authentication bypass vulnerability in the DSoftBus module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-49002 | Critical | 9.8 | 2025-06-03 | DataEase is an open source business intelligence and data visualization tool. Versions prior to version 2.10.10 have a flaw in the patch for CVE-2025-32966 tha… |
CVE-2023-41591 | Critical | 9.8 | 2025-05-29 | An issue in Open Network Foundation ONOS v2.7.0 allows attackers to create fake IP/MAC addresses and potentially execute a man-in-the-middle attack on communic… |
CVE-2025-5067 | Medium | 5.4 | 2025-05-27 | Inappropriate implementation in Tab Strip in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2025-48027 | Medium | 5.4 | 2025-05-15 | The HttpAuth plugin in pGina.Fork through 3.9.9.12 allows authentication bypass when an adversary controls DNS resolution for pginaloginserver. |
CVE-2025-3875 | High | 7.5 | 2025-05-14 | Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From hea… |
CVE-2025-27695 | Medium | 4.9 | 2025-05-08 | Dell Wyse Management Suite, versions prior to WMS 5.1 contain an Authentication Bypass by Spoofing vulnerability. A high privileged attacker with remote access… |
CVE-2025-46345 | | 2025-05-01 | Auth0 Account Link Extension is an extension aimed to help link accounts easily. Versions 2.3.4 to 2.6.6 do not verify the signature of the provided JWT. This… | |
CVE-2025-24091 | Medium | 5.5 | 2025-04-30 | An app could impersonate system notifications. Sensitive notifications now require restricted entitlements. This issue is fixed in iOS 18.3 and iPadOS 18.3, iP… |
CVE-2025-28128 | High | 7.0 | 2025-04-25 | An issue in Mytel Telecom Online Account System v1.0 allows attackers to bypass the OTP verification process via a crafted request. |
CVE-2025-32966 | Critical | 9.8 | 2025-04-23 | DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.8, authenticated users can complete RCE through the backend JDBC link. This is… |
CVE-2025-29621 | High | 7.3 | 2025-04-22 | Francois Jacquet RosarioSIS v12.0.0 was discovered to contain a content spoofing vulnerability in the Theme configuration under the My Preferences module. This… |
CVE-2025-32788 | Medium | 4.3 | 2025-04-22 | OctoPrint provides a web interface for controlling consumer 3D printers. In versions up to and including 1.10.3, OctoPrint has a vulnerability that allows an a… |
CVE-2025-2188 | High | 8.1 | 2025-04-17 | There is a whitelist mechanism bypass in GameCenter ,successful exploitation of this vulnerability may affect service confidentiality and integrity. |
CVE-2025-32012 | High | 7.5 | 2025-04-15 | Jellyfin is an open source self hosted media server. In versions 10.9.0 to before 10.10.7, the /System/Restart endpoint provides administrators the ability to… |
CVE-2023-5616 | Medium | 4.9 | 2025-04-15 | In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for openssh-se… |
CVE-2025-32275 | Medium | 4.3 | 2025-04-10 | Authentication Bypass by Spoofing vulnerability in Ays Pro Survey Maker survey-maker allows Identity Spoofing.This issue affects Survey Maker: from n/a through… |
CVE-2025-32227 | Medium | 4.3 | 2025-04-10 | Authentication Bypass by Spoofing vulnerability in Asgaros Asgaros Forum asgaros-forum allows Identity Spoofing.This issue affects Asgaros Forum: from n/a thro… |
CVE-2024-55210 | Critical | 9.8 | 2025-04-09 | An issue in TOTVS Framework (Linha Protheus) 12.1.2310 allows attackers to bypass multi-factor authentication (MFA) via a crafted websocket message. |
CVE-2025-31170 | High | 8.4 | 2025-04-07 | Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity and confidentialit… |
CVE-2024-58127 | High | 8.4 | 2025-04-07 | Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity and confidentialit… |
CVE-2024-58126 | High | 8.4 | 2025-04-07 | Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity and confidentialit… |
CVE-2024-58125 | High | 8.4 | 2025-04-07 | Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity and confidentialit… |
CVE-2024-58124 | High | 8.4 | 2025-04-07 | Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity and confidentialit… |
CVE-2025-3029 | High | 7.3 | 2025-04-01 | A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This vulnerabilit… |
CVE-2025-31122 | | 2025-03-31 | scratch-coding-hut.github.io is the website for Coding Hut. In 1.0-beta3 and earlier, the login link can be used to login to any account by changing the userna… | |
CVE-2025-22223 | Medium | 5.3 | 2025-03-24 | Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass. … |
CVE-2025-30144 | Medium | 6.5 | 2025-03-19 | fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 5.0.6, the fast-jwt library does not properly validate the iss claim based on the RFC 7519… |
CVE-2025-30142 | High | 8.1 | 2025-03-18 | An issue was discovered on G-Net Dashcam BB GONX devices. Bypassing of Device Pairing can occur. It uses MAC address verification as the sole mechanism for rec… |
CVE-2025-30110 | Medium | 6.5 | 2025-03-18 | On IROAD X5 devices, a Bypass of Device Pairing can occur via MAC Address Spoofing. The dashcam's pairing mechanism relies solely on MAC address verification… |
CVE-2024-54085 | Critical | 9.8 | 2025-03-11 | AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitatio… |
CVE-2025-27616 | High | 8.5 | 2025-03-10 | Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webho… |
CVE-2025-26696 | High | 7.0 | 2025-03-10 | Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown… |
CVE-2025-27671 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Device Impersonation OVE-20230524-0015. |
CVE-2024-13685 | Medium | 5.3 | 2025-03-04 | The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to… |
CVE-2025-22271 | | 2025-02-28 | The application or its infrastructure allows for IP address spoofing by providing its own value in the "X-Forwarded-For" header. Thus, the action logging mecha… | |
CVE-2020-6158 | Medium | 4.7 | 2025-02-21 | Opera Mini for Android before version 52.2 is vulnerable to an address bar spoofing attack. The vulnerability allows a malicious page to trick the browser into… |
CVE-2023-51327 | Medium | 6.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Cleaning Business Software v1.0 allows attackers to send an excessive amount of email fo… |
CVE-2023-51326 | Medium | 6.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Cleaning Business Software v1.0 allows attackers to send an excessive amount of email fo… |
CVE-2023-51323 | Medium | 6.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Shared Asset Booking System v1.0 allows attackers to send an excessive amount of email f… |
CVE-2023-51321 | Medium | 6.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Night Club Booking Software v1.0 allows attackers to send an excessive amount of email f… |
CVE-2025-25055 | Medium | 5.3 | 2025-02-18 | Authentication bypass by spoofing issue exists in FileMegane versions above 1.0.0.0 prior to 3.4.0.0, which may lead to user impersonation. If exploited, restr… |
CVE-2025-1298 | Critical | 9.8 | 2025-02-14 | Logic vulnerability in the mobile application (com.transsion.carlcare) may lead to the risk of account takeover. |
CVE-2025-25182 | Critical | 9.4 | 2025-02-12 | Stroom is a data processing, storage and analysis platform. A vulnerability exists starting in version 7.2-beta.53 and prior to versions 7.2.24, 7.3-beta.22, 7… |
CVE-2022-3180 | Critical | 9.8 | 2025-02-11 | The WPGateway Plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.5. This allows unauthenticated attackers to create… |
CVE-2025-1104 | High | 7.3 | 2025-02-07 | A vulnerability has been found in D-Link DHP-W310AV 1.04 and classified as critical. This vulnerability affects unknown code. The manipulation leads to authent… |
CVE-2024-36557 | Medium | 6.6 | 2025-02-06 | The device ID is based on IMEI in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me 2 KW60 R36CW_YD… |
CVE-2025-21415 | Critical | 9.9 | 2025-01-29 | Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network. |
CVE-2025-24628 | Medium | 5.3 | 2025-01-27 | Authentication Bypass by Spoofing vulnerability in bestwebsoft Google Captcha google-captcha allows Identity Spoofing.This issue affects Google Captcha: from n… |