CWE-290 · Authentication Bypass by Spoofing (page 4)
Page 4 of 8 — CVEs classified under CWE-290, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-43493 | Medium | 4.3 | 2025-11-04 | The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, vis… |
CVE-2025-59501 | Medium | 4.8 | 2025-10-31 | Authentication bypass by spoofing in Microsoft Configuration Manager allows an authorized attacker to perform spoofing over an adjacent network. |
CVE-2025-11843 | | 2025-10-31 | Therefore Corporation GmbH has recently become aware that Therefore™ Online and Therefore™ On-Premises contain an account impersonation vulnerability. A malici… | |
CVE-2025-5605 | Medium | 4.3 | 2025-10-24 | An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate… |
CVE-2025-56800 | Medium | 5.1 | 2025-10-21 | Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism. The application implements lock screen password logic entir… |
CVE-2025-37147 | High | 7.1 | 2025-10-14 | A Secure Boot Bypass Vulnerability exists in affected Access Points that allows an adversary to bypass the hardware root of trust verification in place to ensu… |
CVE-2025-9265 | | 2025-10-13 | A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state… | |
CVE-2025-60868 | Medium | 6.5 | 2025-10-10 | The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enabled. Case variations… |
CVE-2025-61778 | | 2025-10-06 | Akka.NET is a .NET port of the Akka project from the Scala / Java community. In all versions of Akka.Remote from v1.2.0 to v1.5.51, TLS could be enabled via ou… | |
CVE-2025-54288 | Medium | 6.8 | 2025-10-02 | Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any con… |
CVE-2025-59956 | Medium | 6.5 | 2025-09-30 | AgentAPI is an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex. Versions 0.3.3 and below are susceptible to a client-side DNS rebinding attack w… |
CVE-2025-56449 | High | 8.2 | 2025-09-29 | A security vulnerability was identified in Obsidian Scheduler's REST API 5.0.0 thru 6.3.0. If an account is locked out due to not enrolling in MFA (e.g. after… |
CVE-2025-10530 | Medium | 6.5 | 2025-09-16 | Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 143 and Thunderbird 143. |
CVE-2025-59154 | Medium | 5.9 | 2025-09-15 | Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client TLS authentication contains a vulnerabi… |
CVE-2025-7448 | | 2025-09-12 | Wi-SUN unexpected 4- Way Handshake packet receptions may lead to predictable keys and potentially leading to Man in the middle (MitM) attack | |
CVE-2025-26419 | Low | 3.3 | 2025-09-04 | In initPhoneSwitch of SystemSettingsFragment.java, there is a possible FRP bypass due to a logic error in the code. This could lead to local escalation of priv… |
CVE-2025-26428 | Low | 3.2 | 2025-09-04 | In startLockTaskMode of LockTaskController.java, there is a possible lock screen bypass due to a logic error in the code. This could lead to physical escalatio… |
CVE-2025-26421 | Medium | 4.0 | 2025-09-04 | In multiple locations, there is a possible lock screen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additi… |
CVE-2025-56689 | Medium | 4.6 | 2025-09-03 | One Identity by Quest Safeguard for Privileged Passwords Appliance 7.5.1.20903 is vulnerable to One Time Password (OTP)/Multifactor Authentication (MFA) bypass… |
CVE-2025-56608 | Medium | 4.2 | 2025-09-03 | The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in `OkHttpClientWrapper.java`. The `handleDigest… |
CVE-2025-6188 | High | 7.5 | 2025-08-25 | On affected platforms running Arista EOS, maliciously formed UDP packets with source port 3503 may be accepted by EOS. UDP Port 3503 is associated with LspPing… |
CVE-2025-8853 | Critical | 9.8 | 2025-08-11 | Official Document Management System developed by 2100 Technology has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to obtai… |
CVE-2025-36119 | High | 7.1 | 2025-08-08 | IBM i 7.3, 7.4, 7.5, and 7.6 is affected by an authenticated user obtaining elevated privileges with IBM Digital Certificate Manager for i (DCM) due to a web s… |
CVE-2025-50454 | Medium | 6.5 | 2025-08-05 | An Authentication Bypass vulnerability in Blue Access' Cobalt X1 thru 02.000.187 allows an unauthorized attacker to log into the application as an administrato… |
CVE-2025-36594 | Critical | 9.8 | 2025-08-04 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2024 release Versions 7.13.1.0… |
CVE-2025-46018 | Medium | 5.4 | 2025-08-01 | CSC Pay Mobile App 2.19.4 (fixed in version 2.20.0) contains a vulnerability allowing users to bypass payment authorization by disabling Bluetooth at a specifi… |
CVE-2025-54576 | Critical | 9.1 | 2025-07-30 | OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load… |
CVE-2025-43245 | Critical | 9.8 | 2025-07-30 | A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7… |
CVE-2025-31511 | High | 7.3 | 2025-07-22 | An issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. One can bypass manager approval by changing the user ID in a Request%20Building%20Access requ… |
CVE-2025-34065 | | 2025-07-01 | An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function allows unauthenticated acces… | |
CVE-2025-34063 | | 2025-07-01 | A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via th… | |
CVE-2025-34053 | | 2025-07-01 | An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function is used to identify ".cab" r… | |
CVE-2025-23168 | Medium | 6.3 | 2025-06-19 | The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via email or SMS. Versa Di… |
CVE-2025-48937 | Medium | 4.9 | 2025-06-10 | matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. matrix-sdk-crypto since version 0.8.0 and up to 0.11.0 does not correctly valid… |
CVE-2025-49004 | High | 7.5 | 2025-06-09 | Caido is a web security auditing toolkit. Prior to version 0.48.0, due to the lack of protection for DNS rebinding, Caido can be loaded on an attacker-controll… |
CVE-2025-48906 | High | 8.8 | 2025-06-06 | Authentication bypass vulnerability in the DSoftBus module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-49002 | Critical | 9.8 | 2025-06-03 | DataEase is an open source business intelligence and data visualization tool. Versions prior to version 2.10.10 have a flaw in the patch for CVE-2025-32966 tha… |
CVE-2023-41591 | Critical | 9.8 | 2025-05-29 | An issue in Open Network Foundation ONOS v2.7.0 allows attackers to create fake IP/MAC addresses and potentially execute a man-in-the-middle attack on communic… |
CVE-2025-5067 | Medium | 5.4 | 2025-05-27 | Inappropriate implementation in Tab Strip in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2025-48027 | Medium | 5.4 | 2025-05-15 | The HttpAuth plugin in pGina.Fork through 3.9.9.12 allows authentication bypass when an adversary controls DNS resolution for pginaloginserver. |
CVE-2025-3875 | High | 7.5 | 2025-05-14 | Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From hea… |
CVE-2025-27695 | Medium | 4.9 | 2025-05-08 | Dell Wyse Management Suite, versions prior to WMS 5.1 contain an Authentication Bypass by Spoofing vulnerability. A high privileged attacker with remote access… |
CVE-2025-46345 | | 2025-05-01 | Auth0 Account Link Extension is an extension aimed to help link accounts easily. Versions 2.3.4 to 2.6.6 do not verify the signature of the provided JWT. This… | |
CVE-2025-24091 | Medium | 5.5 | 2025-04-30 | An app could impersonate system notifications. Sensitive notifications now require restricted entitlements. This issue is fixed in iOS 18.3 and iPadOS 18.3, iP… |
CVE-2025-28128 | High | 7.0 | 2025-04-25 | An issue in Mytel Telecom Online Account System v1.0 allows attackers to bypass the OTP verification process via a crafted request. |
CVE-2025-32966 | Critical | 9.8 | 2025-04-23 | DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.8, authenticated users can complete RCE through the backend JDBC link. This is… |
CVE-2025-29621 | High | 7.3 | 2025-04-22 | Francois Jacquet RosarioSIS v12.0.0 was discovered to contain a content spoofing vulnerability in the Theme configuration under the My Preferences module. This… |
CVE-2025-32788 | Medium | 4.3 | 2025-04-22 | OctoPrint provides a web interface for controlling consumer 3D printers. In versions up to and including 1.10.3, OctoPrint has a vulnerability that allows an a… |
CVE-2025-2188 | High | 8.1 | 2025-04-17 | There is a whitelist mechanism bypass in GameCenter ,successful exploitation of this vulnerability may affect service confidentiality and integrity. |
CVE-2025-32012 | High | 7.5 | 2025-04-15 | Jellyfin is an open source self hosted media server. In versions 10.9.0 to before 10.10.7, the /System/Restart endpoint provides administrators the ability to… |
CVE-2023-5616 | Medium | 4.9 | 2025-04-15 | In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for openssh-se… |
CVE-2025-32275 | Medium | 4.3 | 2025-04-10 | Authentication Bypass by Spoofing vulnerability in Ays Pro Survey Maker survey-maker allows Identity Spoofing.This issue affects Survey Maker: from n/a through… |
CVE-2025-32227 | Medium | 4.3 | 2025-04-10 | Authentication Bypass by Spoofing vulnerability in Asgaros Asgaros Forum asgaros-forum allows Identity Spoofing.This issue affects Asgaros Forum: from n/a thro… |
CVE-2024-55210 | Critical | 9.8 | 2025-04-09 | An issue in TOTVS Framework (Linha Protheus) 12.1.2310 allows attackers to bypass multi-factor authentication (MFA) via a crafted websocket message. |
CVE-2025-31170 | High | 8.4 | 2025-04-07 | Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity and confidentialit… |
CVE-2024-58127 | High | 8.4 | 2025-04-07 | Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity and confidentialit… |
CVE-2024-58126 | High | 8.4 | 2025-04-07 | Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity and confidentialit… |
CVE-2024-58125 | High | 8.4 | 2025-04-07 | Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity and confidentialit… |
CVE-2024-58124 | High | 8.4 | 2025-04-07 | Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect integrity and confidentialit… |
CVE-2025-3029 | High | 7.3 | 2025-04-01 | A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This vulnerabilit… |
CVE-2025-31122 | | 2025-03-31 | scratch-coding-hut.github.io is the website for Coding Hut. In 1.0-beta3 and earlier, the login link can be used to login to any account by changing the userna… | |
CVE-2025-22223 | Medium | 5.3 | 2025-03-24 | Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass. … |
CVE-2025-30144 | Medium | 6.5 | 2025-03-19 | fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 5.0.6, the fast-jwt library does not properly validate the iss claim based on the RFC 7519… |
CVE-2025-30142 | High | 8.1 | 2025-03-18 | An issue was discovered on G-Net Dashcam BB GONX devices. Bypassing of Device Pairing can occur. It uses MAC address verification as the sole mechanism for rec… |
CVE-2025-30110 | Medium | 6.5 | 2025-03-18 | On IROAD X5 devices, a Bypass of Device Pairing can occur via MAC Address Spoofing. The dashcam's pairing mechanism relies solely on MAC address verification… |
CVE-2024-54085 | Critical | 9.8 | 2025-03-11 | AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitatio… |
CVE-2025-27616 | High | 8.5 | 2025-03-10 | Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webho… |
CVE-2025-26696 | High | 7.0 | 2025-03-10 | Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown… |
CVE-2025-27671 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Device Impersonation OVE-20230524-0015. |
CVE-2024-13685 | Medium | 5.3 | 2025-03-04 | The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to… |
CVE-2025-22271 | | 2025-02-28 | The application or its infrastructure allows for IP address spoofing by providing its own value in the "X-Forwarded-For" header. Thus, the action logging mecha… | |
CVE-2020-6158 | Medium | 4.7 | 2025-02-21 | Opera Mini for Android before version 52.2 is vulnerable to an address bar spoofing attack. The vulnerability allows a malicious page to trick the browser into… |
CVE-2023-51327 | Medium | 6.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Cleaning Business Software v1.0 allows attackers to send an excessive amount of email fo… |
CVE-2023-51326 | Medium | 6.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Cleaning Business Software v1.0 allows attackers to send an excessive amount of email fo… |
CVE-2023-51323 | Medium | 6.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Shared Asset Booking System v1.0 allows attackers to send an excessive amount of email f… |
CVE-2023-51321 | Medium | 6.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Night Club Booking Software v1.0 allows attackers to send an excessive amount of email f… |
CVE-2025-25055 | Medium | 5.3 | 2025-02-18 | Authentication bypass by spoofing issue exists in FileMegane versions above 1.0.0.0 prior to 3.4.0.0, which may lead to user impersonation. If exploited, restr… |
CVE-2025-1298 | Critical | 9.8 | 2025-02-14 | Logic vulnerability in the mobile application (com.transsion.carlcare) may lead to the risk of account takeover. |
CVE-2025-25182 | Critical | 9.4 | 2025-02-12 | Stroom is a data processing, storage and analysis platform. A vulnerability exists starting in version 7.2-beta.53 and prior to versions 7.2.24, 7.3-beta.22, 7… |
CVE-2022-3180 | Critical | 9.8 | 2025-02-11 | The WPGateway Plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.5. This allows unauthenticated attackers to create… |
CVE-2025-1104 | High | 7.3 | 2025-02-07 | A vulnerability has been found in D-Link DHP-W310AV 1.04 and classified as critical. This vulnerability affects unknown code. The manipulation leads to authent… |
CVE-2024-36557 | Medium | 6.6 | 2025-02-06 | The device ID is based on IMEI in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me 2 KW60 R36CW_YD… |
CVE-2025-21415 | Critical | 9.9 | 2025-01-29 | Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network. |
CVE-2025-24628 | Medium | 5.3 | 2025-01-27 | Authentication Bypass by Spoofing vulnerability in bestwebsoft Google Captcha google-captcha allows Identity Spoofing.This issue affects Google Captcha: from n… |
CVE-2024-55925 | High | 7.5 | 2025-01-23 | In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the… |
CVE-2025-24458 | High | 7.1 | 2025-01-21 | In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration |
CVE-2025-0442 | Medium | 6.5 | 2025-01-15 | Inappropriate implementation in Payments in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2025-0440 | Medium | 6.5 | 2025-01-15 | Inappropriate implementation in Fullscreen in Google Chrome on Windows prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HT… |
CVE-2024-13061 | Critical | 9.8 | 2024-12-31 | The Electronic Official Document Management System from 2100 Technology has an Authentication Bypass vulnerability. Although the product enforces an IP whiteli… |
CVE-2024-12108 | Critical | 9.6 | 2024-12-31 | In WhatsUp Gold versions released before 2024.0.2, an attacker can gain access to the WhatsUp Gold server via the public API. |
CVE-2024-54450 | Critical | 9.4 | 2024-12-27 | An issue was discovered in Kurmi Provisioning Suite 7.9.0.33. If an X-Forwarded-For header is received during authentication, the Kurmi application will record… |
CVE-2024-55470 | High | 7.5 | 2024-12-20 | Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successf… |
CVE-2024-55232 | Medium | 5.4 | 2024-12-18 | An IDOR vulnerability in the manage-notes.php module in PHPGurukul Online Notes Sharing Management System v1.0 allows unauthorized users to delete notes belong… |
CVE-2023-41133 | Medium | 5.3 | 2024-12-13 | Authentication Bypass by Spoofing vulnerability in Michal Novák Secure Admin IP allows Functionality Bypass.This issue affects Secure Admin IP: from n/a throug… |
CVE-2024-54158 | Low | 3.5 | 2024-12-04 | In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding |
CVE-2024-50380 | | 2024-12-02 | Snap One OVRC cloud uses the MAC address as an identifier to provide information when requested. An attacker can impersonate other devices by supplying enumera… | |
CVE-2024-53862 | High | 7.5 | 2024-12-02 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. When using `--auth-mode=client`, Archived Work… |
CVE-2024-36466 | High | 8.8 | 2024-11-28 | A bug in the code allows an attacker to sign a forged zbx_session cookie, which then allows them to sign in with admin permissions. |
CVE-2024-11701 | Medium | 4.3 | 2024-11-26 | The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt. This could have led to user confusion and possible sp… |
CVE-2024-11692 | Medium | 4.3 | 2024-11-26 | An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks. This vulnerability… |