CWE-290

636 vulnerabilities with CWE-290

CVE-2026-25660 CRITICAL

Authentication bypass for certain API calls

CVSS 9.8

CVE-2026-40575 CRITICAL

OAuth2 Proxy 7.5.0-7.15.1 X-Forwarded-Uri - Authentication Bypass

CVSS 9.1

CVE-2026-6762 MEDIUM

Mozilla Firefox and Thunderbird 115.35, 140.10, and 150 - DOM Spoofing

CVSS 6.3

CVE-2026-22734 HIGH

Cloud Foundry UAA SAML 2.0 Signature Bypass

CVSS 8.6

CVE-2026-34457 CRITICAL

OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode

CVSS 9.1

CVE-2026-39419 LOW

MaxKB: Sandbox Result Validation Bypass via Tool Output Spoofing

CVSS 3.1

CVE-2026-35656 MEDIUM

OpenClaw < 2026.3.22 - XFF Loopback Spoofing Bypass in Canvas Authentication and Rate Limiter

CVSS 6.5

CVE-2026-35622 MEDIUM

OpenClaw < 2026.3.22 - Improper Authentication Verification in Google Chat Webhook

CVSS 5.9

CVE-2026-39959 HIGH

Tmds.DBus: malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of service

CVSS 7.1

CVE-2026-39411 MEDIUM

LobeHub <2.1.48 webapi Routes - Authentication Bypass

CVSS 5.0

CVE-2026-3902 HIGH

ASGI header spoofing via underscore/hyphen conflation

CVSS 7.5

CVE-2026-34778 MEDIUM

Electron: Service worker can spoof executeJavaScript IPC replies

CVSS 5.9

CVE-2026-33175 HIGH

OAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claims

CVSS 8.8

CVE-2026-33654 CRITICAL

Zero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling

CVSS 9.8

CVE-2026-33433 HIGH

Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField

CVSS 8.8

CVE-2026-33661 HIGH

WeChat Pay callback signature verification bypassed when Host header is localhost

CVSS 8.6

CVE-2026-33621 MEDIUM

PinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Token

CVSS 4.8

CVE-2026-33223 MEDIUM

NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing

CVSS 6.4

CVE-2026-30975 HIGH

Sonarr Authentication Bypass vulnerability

CVSS 8.1

CVE-2026-33246 MEDIUM

NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers

CVSS 6.4

CVE-2026-32492 MEDIUM

WordPress My Tickets plugin <= 2.1.1 - Bypass Vulnerability vulnerability

CVSS 5.3

CVE-2026-24372 HIGH

WordPress Subscriptions for WooCommerce plugin <= 1.8.10 - Bypass Vulnerability vulnerability

CVSS 7.5

CVE-2026-4728 MEDIUM

Spoofing issue in the Privacy: Anti-Tracking component

CVSS 6.5

CVE-2026-32045 MEDIUM

OpenClaw < 2026.2.21 - Authentication Bypass in HTTP Gateway Routes via Tokenless Tailscale Auth

CVSS 5.9

CVE-2026-32666 HIGH

Automated Logic WebCTRL Premium Server Authentication Bypass by Spoofing

CVSS 7.5