CWE-290 Authentication Bypass by Spoofing

Microsoft Security Advisory CVE-2026-70179 - ASP.NET Core Elevation of Privilege Vulnerability

Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header

Payload authentication token field handling issue

mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control

Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write

PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing

Duplicate Advisory: PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

9router /v1 APIs has unauthenticated access via reverse proxy locality collapse

Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses

Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends

Traefik: ForwardAuth identity spoofing via dot-form header alias

webhookd: Unrestricted HTTP Header to Shell Variable Injection

SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy

Duplicate Advisory: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port prox

OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)

9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers

OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers

Duplicate Advisory: OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers

Duplicate Advisory: OpenClaw: QQBot streaming command could mutate config without explicit allowFrom

AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching