Authentication Bypass by Spoofing
CWE-290
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
We track 334 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.5. 8 have been exploited in real attacks.
Latest Authentication Bypass by Spoofing vulnerabilities
- 7.8 High severity
Apache APISIX: Authentication Bypass by Spoofing
Authentication bypass by spoofing vulnerability in Apache APISIX. On routes using jwe-decrypt with strict: false and a forward_header distinct from the token header an unauthenticated client can supply the value the upstream treats as gateway-decrypted plainte
- 7.4 High severity
frankenphp: Authentication Bypass by Spoofing
FrankenPHP before 1.13.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to spoof trusted headers by sending dot-form header names that PHP rewrites to underscores. Attackers can send headers like X.Authenticated.User or X
- 7.2 High severity
FortiManager: Authentication Bypass by Spoofing
A authentication bypass by spoofing vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer C
- 8.2 High severity
FortiManager: Authentication Bypass by Spoofing
A authentication bypass by spoofing vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 thr
- 9.8 Critical severity
AVideo: Authentication Bypass by Spoofing
WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user via Hybridauth social login display names. Attackers can set their X, Facebook, Yahoo or LinkedIn display name to a victi
- 9.3 Critical severity
Intel(R) TDX Migration Trust Domain (MigTD): Authentication Bypass by Spoofing
Authentication bypass by spoofing in the MigTD rebinding protocol for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexit
- 7.5 High severity
hickory-dns: Authentication Bypass by Spoofing
Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone
- 9.8 Critical severity
OpenAM: Authentication Bypass by Spoofing
OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. Unauthenticated remote attackers can submit
- 8.3 High severity
API Connect: Authentication Bypass by Spoofing
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's
- 9.4 Critical severity
API Connect: Authentication Bypass by Spoofing
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and modify API configurations due to improper authentication. Identity information supplied in requests is not sufficiently verified, which could allow a ca
- 8.5 High severity
API Connect: Authentication Bypass by Spoofing
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to create unauthorized user accounts due to improper verification of cryptographic signatures. Identity information from a login provider is ac
- 7.5 High severity
API Connect: Authentication Bypass by Spoofing
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain unauthorized access to sensitive API catalog and runtime configuration data due to improper authentication. Information supplied by the client is not sufficiently verified, which c
- 8.5 High severity
API Connect: Authentication Bypass by Spoofing
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. Information supplied by the client is not sufficiently verified, which could al
- 9.1 Critical severity
freeswitch: Authentication Bypass by Spoofing
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, FreeSWITCH's inbound ICE handling accepted every connectivit
- 8.8 High severity
ThinLinc: Authentication Bypass by Spoofing
Cendio ThinLinc contains an improper authentication vulnerability in its browser-based web client (tlwebaccess) that allows an authenticated attacker to impersonate any other user, including root, by exploiting flaws in multi-step authentication flows such as
- 8.3 High severity
TrueNAS SCALE: Authentication Bypass by Spoofing
Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release trains before their respective fixes) allows an attacker on the same network segment to achieve unauthenticated full-administrator API access
- 9.8 Critical severity
VitaFit: Authentication Bypass by Spoofing
VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoin
- 9.8 Critical severity
GPUStack Improper Authentication Exploited
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, whi
- 8.1 High severity
Databasement: Authentication Bypass by Spoofing
Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser() that links OIDC identities to local users by email without checking email_verified. Attackers can register an identity provider account with a v
- 7.7 High severity
symfony: Authentication Bypass by Spoofing
Authentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows an attacker holding a certificate from the application's trusted
- 9.3 Critical severity
assent: Authentication Bypass by Spoofing
Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback. Apple post
- 7.9 High severity
Rancher: Authentication Bypass by Spoofing
A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions before 0.12, 0.13.0 up to 0.13.17, 0.14.0 up to 0.14.12, 0.15.0 up t o 0.15.17 and 0.16.0 up to 0.16.3. The cluster identity claimed by a registration
- 7.1 High severity
OpenManage Enterprise: Authentication Bypass by Spoofing
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Session theft.
- 9.1 Critical severity
PowerProtect Data Domain Management Center: Authentication Bypass by Spoofing
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an
- 9.4 Critical severity
Fireware OS: Improper Neutralization of Special Elements used in a Command
A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall management actions as root by
- 7.5 High severity
Agentic AI / Agentic Ally: Authentication Bypass by Spoofing
Authentication bypass by spoofing vulnerability in Keepnet Labs Ltd. Agentic AI / Agentic Ally allows Authentication Bypass. This issue affects Agentic AI / Agentic Ally: before 0ef61f2e.
- 9.8 Critical severity
HiRDB Server Version 10: Authentication Bypass by Spoofing
Authentication Bypass by Spoofing Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V;
- 9.8 Critical severity
JP1/Automatic Job Management System 3 - Manager: Authentication Bypass by Spoofing
Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3. This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31.
- 7.8 High severity
macOS: Authentication Bypass by Spoofing
A downgrade issue was addressed with additional version checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.
- 9.9 Critical severity
postiz-app: Authentication Bypass by Spoofing
Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the
- 7.0 High severity
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service.
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers
- 8.8 High severity
CGM CLININET: Authentication Bypass by Spoofing
The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and gain the ability to edit
- 9.8 Critical severity
bytebase: Authentication Bypass by Spoofing
Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLAB_SELF_HOST en
- 9.8 Critical severity
SureCart: Authentication Bypass by Spoofing
Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5.
- 8.7 High severity
traefik: Authentication Bypass by Spoofing
Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-c
- 9.3 Critical severity
SuggestArr: Authentication Bypass by Spoofing
SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, which is derived from the s
- 7.4 High severity
wimoor: Authentication Bypass by Spoofing
WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway
- 9.8 Critical severity
BeyondTrust Remote Support Authentication Bypass by Spoofing Exploited
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations
- 9.1 Critical severity
joserfc: Authentication Bypass by Spoofing
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated.
- 9.8 Critical severity
Acropolis Operating System (AOS): Authentication Bypass by Spoofing
An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the applicat