Skip to content
Log inStart free trial

CWE-290: Authentication Bypass by Spoofing

Base

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Consequences

  • Access Control: Bypass Protection Mechanism, Gain Privileges or Assume Identity

Recent advisories

  • CVE-2026-102764 — The vulnerability exists within internal components of BeyondTrust’s Remote Support product.
  • CVE-2026-104935 — Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.
  • GHSA-xv7q-fvmc-jx96 — Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover
  • GHSA-9q47-3cm2-2rp8 — pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header
  • GHSA-66wr-7vmr-p5jq — Payload authentication token field handling issue
  • GHSA-4f6c-2vvp-gw82 — Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write
  • EEF-CVE-2026-76949 — Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement
  • EEF-CVE-2026-91039 — dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover
  • GHSA-jqcg-44mw-7w3h — proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
  • GHSA-rf44-j88r-hh8c — Traefik: ForwardAuth identity spoofing via dot-form header alias
  • GHSA-3mp7-4rh5-jrv9 — SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy
  • GHSA-93qh-5269-9wcf — Statamic: Account takeover via OAuth email matching without email-verification check
  • GHSA-qj9c-59p6-8cgx — PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing
  • GHSA-x5c9-v98j-722r — 9router /v1 APIs has unauthenticated access via reverse proxy locality collapse
  • GHSA-86m2-fcxq-5q7c — 9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

All advisories for CWE-290

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor