Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

CVEs (627)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-37082 - - Jun 17, 2026 Jul 3, 2024 N/A· v4 9.1 CRITICAL· v3 N/A· v2 When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be possible to craft HTTP requests that bypass mTLS authentication to Cloud Foundry applications. You a...Show more When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be possible to craft HTTP requests that bypass mTLS authentication to Cloud Foundry applications. You are affected if you have route-services enabled in routing-release and have configured the haproxy-boshrelease property “ha_proxy.forwarded_client_cert” to “forward_only_if_route_service”.Show less
CVE-2024-39350 1Synology 2Bc500 Firmware Tc500 Firmware Jun 17, 2026 Jun 28, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 A vulnerability regarding authentication bypass by spoofing is found in the RTSP functionality. This allows man-in-the-middle attackers to obtain privileges without consent via unspecified vectors. The following models w...Show more A vulnerability regarding authentication bypass by spoofing is found in the RTSP functionality. This allows man-in-the-middle attackers to obtain privileges without consent via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.7-0298 may be affected: BC500 and TC500.Show less
CVE-2024-31802 - - Jun 17, 2026 Jun 27, 2024 N/A· v4 6.3 MEDIUM· v3 N/A· v2 DESIGNA ABACUS v.18 and before allows an attacker to bypass the payment process via a crafted QR code.
CVE-2024-4846 1Devolutions 1Devolutions Server Jun 17, 2026 Jun 25, 2024 N/A· v4 6.3 MEDIUM· v3 N/A· v2 Authentication bypass in the 2FA feature in Devolutions Server 2024.1.14.0 and earlier allows an authenticated attacker to authenticate to another user without being asked for the 2FA via another browser tab.
CVE-2024-39337 - - Jun 17, 2026 Jun 24, 2024 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Click Studios Passwordstate Core before 9.8 build 9858 allows Authentication Bypass.
CVE-2024-21518 1Opencart 1Opencart Jun 17, 2026 Jun 22, 2024 N/A· v4 7.2 HIGH· v3 N/A· v2 This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archiv...Show more This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extracted to arbitrary locations. An attacker can create arbitrary files in the web root of the application and overwrite other existing files by exploiting this vulnerability.Show less
CVE-2024-30058 1Microsoft 1Edge Chromium Jul 20, 2026 Jun 13, 2024 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2024-36588 - - Jun 17, 2026 Jun 13, 2024 N/A· v4 6.5 MEDIUM· v3 N/A· v2 An issue in Annonshop.app DecentralizeJustice/ anonymousLocker commit 2b2b4 allows attackers to send messages erroneously attributed to arbitrary users via a crafted HTTP request.
CVE-2024-5812 1Beyondtrust 1Beyondinsight Password Safe Jun 17, 2026 Jun 11, 2024 N/A· v4 2.7 LOW· v3 N/A· v2 A low severity vulnerability in BIPS has been identified where an attacker with high privileges or a compromised high privilege account can overwrite Read-Only smart rules via a specially crafted API request.
CVE-2024-35749 1Acurax 1Under Construction / Maintenance Mode Jun 17, 2026 Jun 10, 2024 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Authentication Bypass by Spoofing vulnerability in Acurax Under Construction / Maintenance Mode from Acurax allows Authentication Bypass.This issue affects Under Construction / Maintenance Mode from Acurax: from n/a thro...Show more Authentication Bypass by Spoofing vulnerability in Acurax Under Construction / Maintenance Mode from Acurax allows Authentication Bypass.This issue affects Under Construction / Maintenance Mode from Acurax: from n/a through 2.6.Show less
CVE-2024-5037 1Redhat 2Openshift Container Platform Openshift Distributed Tracing Jun 17, 2026 Jun 5, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 A flaw was found in OpenShift's Telemeter. If certain conditions are in place, an attacker can use a forged token to bypass the issue ("iss") check during JSON web token (JWT) authentication.
CVE-2023-52176 - - Jun 17, 2026 Jun 4, 2024 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Authentication Bypass by Spoofing vulnerability in miniorange Malware Scanner allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Malware Scanner: from n/a through 4.7.1.
CVE-2023-51667 1Blazzdev 1Rate My Post Jun 17, 2026 Jun 4, 2024 N/A· v4 8.2 HIGH· v3 N/A· v2 Authentication Bypass by Spoofing vulnerability in FeedbackWP Rate my Post – WP Rating System allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Rate my Post – WP Rating System: from n/a t...Show more Authentication Bypass by Spoofing vulnerability in FeedbackWP Rate my Post – WP Rating System allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Rate my Post – WP Rating System: from n/a through 3.4.2.Show less
CVE-2023-51543 1Metagauss 1Registrationmagic Jun 17, 2026 Jun 4, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 Authentication Bypass by Spoofing vulnerability in Metagauss RegistrationMagic allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects RegistrationMagic: from n/a through 5.2.5.0.
CVE-2023-51542 - - Jun 17, 2026 Jun 4, 2024 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Authentication Bypass by Spoofing vulnerability in WPMU DEV Branda allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Branda: from n/a through 3.4.14.
CVE-2023-49741 - - Jun 17, 2026 Jun 4, 2024 N/A· v4 3.7 LOW· v3 N/A· v2 Authentication Bypass by Spoofing vulnerability in wpdevart Coming soon and Maintenance mode allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Coming soon and Maintenance mode: from n/a t...Show more Authentication Bypass by Spoofing vulnerability in wpdevart Coming soon and Maintenance mode allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Coming soon and Maintenance mode: from n/a through 3.7.3.Show less
CVE-2023-48753 - - Jun 17, 2026 Jun 4, 2024 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Authentication Bypass by Spoofing vulnerability in 10up Restricted Site Access allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Restricted Site Access: from n/a through 7.4.1.
CVE-2023-48271 - - Jun 17, 2026 Jun 4, 2024 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Authentication Bypass by Spoofing vulnerability in yonifre Maspik – Spam blacklist allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Maspik – Spam blacklist: from n/a through 0.10.3.
CVE-2023-47769 - - Jun 17, 2026 Jun 4, 2024 N/A· v4 3.7 LOW· v3 N/A· v2 Authentication Bypass by Spoofing vulnerability in WP Maintenance allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Maintenance: from n/a through 6.1.3.
CVE-2023-41134 - - Jun 17, 2026 Jun 4, 2024 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Authentication Bypass by Spoofing vulnerability in pluginkollektiv Antispam Bee allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Antispam Bee: from n/a through 2.11.3.

Previous 1...161718...32 Next