CWE-290: Authentication Bypass by Spoofing
Sources read 2026-10-30. MITRE's own page · All weakness notes · Added to CISA's list in the last seven days
What it is
From MITRE's CWE catalogue
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
MITRE classes it as a base-level weakness.
What it lets an attacker do
From MITRE's CWE catalogue
- Bypass Protection Mechanism, Gain Privileges or Assume Identity (affects: access control)
On CISA's exploited list
From CISA's exploited list
2 of the 109 entries CISA added from 2026-08-04 to 2026-11-01 name CWE-290, against 0 of 70 in the 90 days before. Over the whole catalogue 7 entries name it. The counts are small, so read them as a rough order, not a rate.
CISA's list is not every flaw that is exploited: it holds the ones CISA has evidence of, listed on the day it added them.
- CVE-2026-102764, BeyondTrust Remote Support, added 2026-10-16
- CVE-2026-104935, Ivanti Connect Secure, added 2026-10-13
- CVE-2023-50224, TP-Link TL-WR841N, added 2025-09-03
- CVE-2024-54085, AMI MegaRAC SPx, added 2025-06-25
- CVE-2024-4358, Progress Telerik Report Server, added 2024-06-13
Attack patterns MITRE links to it
From MITRE's CWE catalogue
- CAPEC-21: Exploitation of Trusted Identifiers
- CAPEC-22: Exploiting Trust in Client
- CAPEC-459: Creating a Rogue Certification Authority Certificate
- CAPEC-461: Web Services API Signature Forgery Leveraging Hash Function Extension Weakness
- CAPEC-473: Signature Spoof
- CAPEC-476: Signature Spoofing by Misrepresentation
Start with one piece of work.
Give us one piece of work and read access to one system. We map it and come back with what we found, what we would build and what it would take — before any commitment. You decide using our output, not our pitch.
Talk to us