GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Common Weakness Enumeration

CWE-290

Allowed

Authentication Bypass by Spoofing

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

1038 vulnerabilities reference this CWE, most recent first.

CVE-2026-19538 (GCVE-0-2026-19538)

Vulnerability from cvelistv5 – Published: 2026-08-26 08:47 – Updated: 2026-08-26 14:00
VLAI
Title
Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS
Summary
The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open.
Severity
8.2 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 13:51 UTC
CWE
  • CWE-290 - Authentication Bypass by Spoofing
  • CWE-672 - Operation on a Resource after Expiration or Release
Assigner
References
Impacted products
Vendor Product Version
NLnet Labs NSD Affected: 4.8.0 , < 4.15.1 (semver)
Create a notification for this product.
Date Public
2026-08-26 12:00
Credits
Qifan Zhang from Palo Alto Networks
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19538",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T13:51:21.490331Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T14:00:12.918Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "NSD",
          "vendor": "NLnet Labs",
          "versions": [
            {
              "lessThan": "4.15.1",
              "status": "affected",
              "version": "4.8.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Qifan Zhang from Palo Alto Networks"
        }
      ],
      "datePublic": "2026-08-26T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Explicitly denied access to the proxy protocol port is bypassed on TCP or TLS"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290 Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-672",
              "description": "CWE-672 Operation on a Resource after Expiration or Release",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T08:47:08.992Z",
        "orgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
        "shortName": "NLnet Labs"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-19538.txt"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "This issue is fixed in 4.15.1 and all later versions."
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-15T18:04:25.000Z",
          "value": "Issue reported by Qifan Zhang"
        },
        {
          "lang": "en",
          "time": "2026-08-10T07:56:32.000Z",
          "value": "NLnet Labs shares patch"
        },
        {
          "lang": "en",
          "time": "2026-08-15T00:00:00.000Z",
          "value": "Qifan Zhang verifies patch"
        },
        {
          "lang": "en",
          "time": "2026-08-26T12:00:00.000Z",
          "value": "Fix released with version 4.15.1"
        }
      ],
      "title": "Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "206fc3a0-e175-490b-9eaa-a5738056c9f6",
    "assignerShortName": "NLnet Labs",
    "cveId": "CVE-2026-19538",
    "datePublished": "2026-08-26T08:47:08.992Z",
    "dateReserved": "2026-08-11T10:27:22.294Z",
    "dateUpdated": "2026-08-26T14:00:12.918Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19291 (GCVE-0-2026-19291)

Vulnerability from cvelistv5 – Published: 2026-08-13 14:16 – Updated: 2026-08-13 17:01
VLAI
Title
Bluetooth re-pairing can use a lower security level than previous
Summary
Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x impacted. See V3 in the BLERP paper linked below.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 17:01 UTC
CWE
  • CWE-290 - Authentication bypass by spoofing
Assigner
References
Impacted products
Vendor Product Version
silabs.com WiseConnect Affected: 4.0.0 , < 4.1.0 (semver)
Affected: 2.0.0 , < 2.14.0 (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19291",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T17:01:41.174827Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T17:01:52.758Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "SiSDK",
          "product": "WiseConnect",
          "vendor": "silabs.com",
          "versions": [
            {
              "lessThan": "4.1.0",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.14.0",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x impacted. See V3 in the BLERP paper linked below."
            }
          ],
          "value": "Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x impacted. See V3 in the BLERP paper linked below."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290 Authentication bypass by spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T14:16:28.037Z",
        "orgId": "030b2754-1501-44a4-bef8-48be86a33bf4",
        "shortName": "Silabs"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://docs.silabs.com/sisdk-release-notes/latest/sisdk-wifi-release-notes/sisdk-wifible-ble-release-notes"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://docs.silabs.com/rs9116-wiseconnect/latest/wifibt-wc-release-notes/rs9116-ble-release-notes#bug-fixes"
        },
        {
          "tags": [
            "vendor-advisory",
            "permissions-required"
          ],
          "url": "https://community.silabs.com/068Vm00000x0yyH"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://www.ndss-symposium.org/ndss-paper/blerp-ble-re-pairing-attacks-and-defenses/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Bluetooth re-pairing can use a lower security level than previous",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "030b2754-1501-44a4-bef8-48be86a33bf4",
    "assignerShortName": "Silabs",
    "cveId": "CVE-2026-19291",
    "datePublished": "2026-08-13T14:16:28.037Z",
    "dateReserved": "2026-08-07T16:20:57.991Z",
    "dateUpdated": "2026-08-13T17:01:52.758Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19117 (GCVE-0-2026-19117)

Vulnerability from cvelistv5 – Published: 2026-09-02 18:04 – Updated: 2026-09-02 18:32
VLAI
Title
Delinea Secret Server FIDO2 credential registration authentication bypass vulnerability
Summary
Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 18:31 UTC
CWE
  • CWE-290 - Authentication bypass by spoofing
Assigner
References
URL Tags
https://delinea.com/security-advisories vendor-advisory
Impacted products
Vendor Product Version
Delinea Secret Server (On-Prem) Affected: 10.6.0 , ≤ 11.7.61 (custom)
Affected: 11.8.0 , ≤ 11.8.1 (custom)
Affected: 11.9.0 , ≤ 11.9.47 (custom)
Affected: 12.0.0 , ≤ 12.0.22 (custom)
Affected: 12.1.0 , ≤ 12.1.2 (custom)
Create a notification for this product.
Date Public
2026-09-02 18:10
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19117",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-02T18:31:57.089249Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-02T18:32:08.651Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Secret Server (On-Prem)",
          "vendor": "Delinea",
          "versions": [
            {
              "lessThanOrEqual": "11.7.61",
              "status": "affected",
              "version": "10.6.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "11.8.1",
              "status": "affected",
              "version": "11.8.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "11.9.47",
              "status": "affected",
              "version": "11.9.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.0.22",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.1.2",
              "status": "affected",
              "version": "12.1.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-09-02T18:10:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as\u003cbr\u003ethat user. This issue affects on-premises deployments only."
            }
          ],
          "value": "Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as\nthat user. This issue affects on-premises deployments only."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290 Authentication bypass by spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T18:09:06.788Z",
        "orgId": "1443cd92-d354-46d2-9290-d812316ca43a",
        "shortName": "Delinea"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://delinea.com/security-advisories"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade to secret server version 12.2.7 or later, or upgrade to one of the following hotfixes: 12.1.3, 12.0.23, 11.9.48, 11.8.2, or 11.7.62.\u003cbr\u003e\u003cbr\u003eCustomers on versions prior to 11.7 should upgrade to a supported version to address this vulnerability\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Upgrade to secret server version 12.2.7 or later, or upgrade to one of the following hotfixes: 12.1.3, 12.0.23, 11.9.48, 11.8.2, or 11.7.62.\n\nCustomers on versions prior to 11.7 should upgrade to a supported version to address this vulnerability"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Delinea Secret Server FIDO2 credential registration authentication bypass vulnerability",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1443cd92-d354-46d2-9290-d812316ca43a",
    "assignerShortName": "Delinea",
    "cveId": "CVE-2026-19117",
    "datePublished": "2026-09-02T18:04:50.665Z",
    "dateReserved": "2026-08-06T14:39:05.258Z",
    "dateUpdated": "2026-09-02T18:32:08.651Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18972 (GCVE-0-2026-18972)

Vulnerability from cvelistv5 – Published: 2026-08-11 12:30 – Updated: 2026-08-11 13:51
VLAI
Title
Velociraptor authenticated identity-spoofing vulnerability
Summary
An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This can lead to an account takeover attack from a user with low privileges to administrator.
Severity
9.6 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 13:48 UTC
CWE
  • CWE-290 - Authentication bypass by spoofing
Assigner
References
Impacted products
Vendor Product Version
Rapid7 Velociraptor Affected: 0 , < 0.77.2 (semver)
    cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Yuval Miller Leon Kayaliev
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18972",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T13:48:57.252540Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T13:51:00.275Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Velociraptor",
          "repo": "https://github.com/Velocidex/velociraptor/",
          "vendor": "Rapid7",
          "versions": [
            {
              "lessThan": "0.77.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cpre\u003eThe attacker must have access to the Velociraptor GUI with at least the \\\"reader\\\" role.\u003c/pre\u003e"
            }
          ],
          "value": "The attacker must have access to the Velociraptor GUI with at least the \\\"reader\\\" role."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.77.2",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yuval Miller"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Leon Kayaliev"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cpre\u003eAn authenticated attacker can spoof another GUI user\u0027s identity by sending their request with the custom header \\\"Grpc-Metadata-USER\\\". This can lead to an account takeover attack from a user with low privileges to administrator.\u003c/pre\u003e"
            }
          ],
          "value": "An authenticated attacker can spoof another GUI user\u0027s identity by sending their request with the custom header \\\"Grpc-Metadata-USER\\\". This can lead to an account takeover attack from a user with low privileges to administrator."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-21",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-21 Exploitation of Trusted Identifiers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290 Authentication bypass by spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T12:30:52.574Z",
        "orgId": "9974b330-7714-4307-a722-5648477acda7",
        "shortName": "rapid7"
      },
      "references": [
        {
          "url": "http://docs.velociraptor.app/announcements/advisories/cve-2026-18972/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Velociraptor authenticated identity-spoofing vulnerability",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cpre\u003eIf you have a proxy in front of the Velociraptor GUI server, you can block the \\\"Grpc-Metadata-USER\\\" header.\u003c/pre\u003e"
            }
          ],
          "value": "If you have a proxy in front of the Velociraptor GUI server, you can block the \\\"Grpc-Metadata-USER\\\" header."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7",
    "assignerShortName": "rapid7",
    "cveId": "CVE-2026-18972",
    "datePublished": "2026-08-11T12:30:52.574Z",
    "dateReserved": "2026-08-05T16:09:39.892Z",
    "dateUpdated": "2026-08-11T13:51:00.275Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18677 (GCVE-0-2026-18677)

Vulnerability from cvelistv5 – Published: 2026-08-12 18:47 – Updated: 2026-08-13 14:49
VLAI
Title
Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity
Summary
In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane presenting a tags-bound token can register with kuma.io/workload set to any value and obtain another workload's SPIFFE identity.
Severity
6 (Medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 14:49 UTC
CWE
  • CWE-290 - Authentication Bypass by Spoofing
Assigner
References
Impacted products
Vendor Product Version
Kong Inc. Kong Mesh Affected: 2.13.0 , < 2.13.10 (semver)
Affected: 2.14.0 , < 2.14.2 (semver)
Create a notification for this product.
Credits
kanywst
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18677",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T14:49:14.103209Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T14:49:27.614Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "kuma-cp"
          ],
          "platforms": [
            "Linux"
          ],
          "product": "Kong Mesh",
          "vendor": "Kong Inc.",
          "versions": [
            {
              "lessThan": "2.13.10",
              "status": "affected",
              "version": "2.13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.14.2",
              "status": "affected",
              "version": "2.14.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eYou are affected if all of the following hold:\u003c/p\u003e\u003cul\u003e\u003cli\u003eThe control plane runs in universal mode.\u003c/li\u003e\u003cli\u003eA \u003ccode\u003eMeshIdentity\u003c/code\u003e is configured whose SPIFFE ID path template derives from the workload label, including the default universal template \u003ccode\u003e/workload/{{ .Workload }}\u003c/code\u003e.\u003c/li\u003e\u003cli\u003eDataplanes authenticate with tokens that are not bound to a workload (tags-bound tokens, the common case, since workload binding is newer and optional).\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eYou are not affected if:\u003c/p\u003e\u003cul\u003e\u003cli\u003eThe control plane runs in Kubernetes mode. Its identity template is \u003ccode\u003e/ns/{{ .Namespace }}/sa/{{ .ServiceAccount }}\u003c/code\u003e, and the control plane derives those values from the pod\u0027s real identity rather than from a label the workload sets.\u003c/li\u003e\u003cli\u003eYour \u003ccode\u003eMeshIdentity\u003c/code\u003e uses a SPIFFE template that does not reference the workload label.\u003c/li\u003e\u003cli\u003eEvery dataplane whose identity derives from the workload label already uses a workload-bound token.\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "You are affected if all of the following hold:\n\n  *  The control plane runs in universal mode.\n  *  A MeshIdentity is configured whose SPIFFE ID path template derives from the workload label, including the default universal template /workload/{{ .Workload }}.\n  *  Dataplanes authenticate with tokens that are not bound to a workload (tags-bound tokens, the common case, since workload binding is newer and optional).\n\n\n\n\nYou are not affected if:\n\n  *  The control plane runs in Kubernetes mode. Its identity template is /ns/{{ .Namespace }}/sa/{{ .ServiceAccount }}, and the control plane derives those values from the pod\u0027s real identity rather than from a label the workload sets.\n  *  Your MeshIdentity uses a SPIFFE template that does not reference the workload label.\n  *  Every dataplane whose identity derives from the workload label already uses a workload-bound token."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "kanywst"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Kong Mesh running in universal mode with a \u003ccode\u003eMeshIdentity\u003c/code\u003e whose SPIFFE ID path template derives from the dataplane\u0027s \u003ccode\u003ekuma.io/workload\u003c/code\u003e label, the XDS authenticator in \u003ccode\u003ekuma-cp\u003c/code\u003e validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane presenting a tags-bound token can register with \u003ccode\u003ekuma.io/workload\u003c/code\u003e set to any value and obtain another workload\u0027s SPIFFE identity.\u003c/p\u003e"
            }
          ],
          "value": "In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane\u0027s kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane presenting a tags-bound token can register with kuma.io/workload set to any value and obtain another workload\u0027s SPIFFE identity."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Workload identity spoofing"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290 Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T18:47:06.710Z",
        "orgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
        "shortName": "Kong"
      },
      "references": [
        {
          "name": "Upstream advisory GHSA-744g-c785-x65q",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/kumahq/kuma/security/advisories/GHSA-744g-c785-x65q"
        },
        {
          "name": "kumahq/kuma#17474 (master)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/kumahq/kuma/pull/17474"
        },
        {
          "name": "kumahq/kuma#17503 (release-2.13 backport)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/kumahq/kuma/pull/17503"
        },
        {
          "name": "kumahq/kuma#17502 (release-2.14 backport)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/kumahq/kuma/pull/17502"
        },
        {
          "name": "Kong MESH Changelog",
          "tags": [
            "release-notes"
          ],
          "url": "https://developer.konghq.com/mesh/changelog/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade to Kong Mesh 2.13.10 or 2.14.2, whichever matches your release line. In patched versions a dataplane whose identity derives from the \u003ccode\u003ekuma.io/workload\u003c/code\u003e label requires a workload-bound token; an unbound tags-only token is rejected at XDS authentication. Kubernetes mode and universal templates that do not reference the workload label keep working with unbound tokens.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade to Kong Mesh 2.13.10 or 2.14.2, whichever matches your release line. In patched versions a dataplane whose identity derives from the kuma.io/workload label requires a workload-bound token; an unbound tags-only token is rejected at XDS authentication. Kubernetes mode and universal templates that do not reference the workload label keep working with unbound tokens."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-01T16:58:00.000Z",
          "value": "Kong Mesh 2.13.10 and 2.14.2 published"
        }
      ],
      "title": "Kong Mesh: a dataplane token without a workload binding can claim any workload\u0027s SPIFFE identity",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIssue workload-bound dataplane tokens for every dataplane whose identity derives from the \u003ccode\u003ekuma.io/workload\u003c/code\u003e label. A workload-bound token constrains that label to the bound value, so a mismatched label is rejected at authentication.\u003c/p\u003e"
            }
          ],
          "value": "Issue workload-bound dataplane tokens for every dataplane whose identity derives from the kuma.io/workload label. A workload-bound token constrains that label to the bound value, so a mismatched label is rejected at authentication."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
    "assignerShortName": "Kong",
    "cveId": "CVE-2026-18677",
    "datePublished": "2026-08-12T18:47:06.710Z",
    "dateReserved": "2026-08-03T15:20:45.630Z",
    "dateUpdated": "2026-08-13T14:49:27.614Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18639 (GCVE-0-2026-18639)

Vulnerability from cvelistv5 – Published: 2026-08-11 15:05 – Updated: 2026-08-11 17:14
VLAI
Title
Velociraptor OIDC Authenticator susceptible to email spoofing
Summary
When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email. This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.
Severity
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 17:13 UTC
CWE
  • CWE-290 - Authentication bypass by spoofing
Assigner
References
Impacted products
Vendor Product Version
Rapid7 Velociraptor Affected: 0 , < 0.77.2 (semver)
Create a notification for this product.
Credits
Leonardo Souza (anauaque)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18639",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T17:13:54.338948Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T17:14:12.967Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Velociraptor",
          "repo": "https://github.com/Velocidex/velociraptor/",
          "vendor": "Rapid7",
          "versions": [
            {
              "lessThan": "0.77.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Velociraptor must be configured to use an IdP which does not verify a user\u0027s email and allows the user to set their email. Examples include Azure IdP and Keycloak in self enrollment mode."
            }
          ],
          "value": "Velociraptor must be configured to use an IdP which does not verify a user\u0027s email and allows the user to set their email. Examples include Azure IdP and Keycloak in self enrollment mode."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Leonardo Souza (anauaque)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eWhen Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the \"email_verified\" claim and do not actually verify the email.\u003c/p\u003e\u003cdiv\u003eThis allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.\u003c/div\u003e"
            }
          ],
          "value": "When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the \"email_verified\" claim and do not actually verify the email.\n\nThis allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-22",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-22 Exploiting Trust in Client"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290 Authentication bypass by spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T15:05:42.703Z",
        "orgId": "9974b330-7714-4307-a722-5648477acda7",
        "shortName": "rapid7"
      },
      "references": [
        {
          "url": "http://docs.velociraptor.app/announcements/advisories/cve-2026-18639/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Velociraptor OIDC Authenticator susceptible to email spoofing",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "You can change the claim that Velociraptor uses as the username using the\u0026nbsp;\u003ca href=\"https://docs.velociraptor.app/docs/deployment/references/#GUI.authenticator.claims.username\"\u003eConfiguration File\u003c/a\u003e\u0026nbsp;. Set the username using a more permanent claim for example with Azure the \"upn\" or \"oid\" can not be chosen by the user."
            }
          ],
          "value": "You can change the claim that Velociraptor uses as the username using the\u00a0 Configuration File https://docs.velociraptor.app/docs/deployment/references/#GUI.authenticator.claims.username \u00a0. Set the username using a more permanent claim for example with Azure the \"upn\" or \"oid\" can not be chosen by the user."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7",
    "assignerShortName": "rapid7",
    "cveId": "CVE-2026-18639",
    "datePublished": "2026-08-11T15:05:42.703Z",
    "dateReserved": "2026-08-03T10:45:09.071Z",
    "dateUpdated": "2026-08-11T17:14:12.967Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16101 (GCVE-0-2026-16101)

Vulnerability from cvelistv5 – Published: 2026-08-13 14:15 – Updated: 2026-08-13 17:01
VLAI
Title
forced re-pairing with already bonded device
Summary
Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 17:01 UTC
CWE
  • CWE-290 - Authentication bypass by spoofing
Assigner
References
Impacted products
Vendor Product Version
silabs.com WiseConnect Affected: 4.0.0 , < 4.1.0 (semver)
Affected: 2.0.0 , < 2.14.0 (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-16101",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T17:01:06.822132Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T17:01:15.389Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "SiSDK",
          "product": "WiseConnect",
          "vendor": "silabs.com",
          "versions": [
            {
              "lessThan": "4.1.0",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.14.0",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below"
            }
          ],
          "value": "Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-114",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-114 Authentication Abuse"
            }
          ]
        },
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290 Authentication bypass by spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T14:15:39.654Z",
        "orgId": "030b2754-1501-44a4-bef8-48be86a33bf4",
        "shortName": "Silabs"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://docs.silabs.com/sisdk-release-notes/latest/sisdk-wifi-release-notes/sisdk-wifible-ble-release-notes"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://docs.silabs.com/rs9116-wiseconnect/latest/wifibt-wc-release-notes/rs9116-ble-release-notes#bug-fixes"
        },
        {
          "tags": [
            "vendor-advisory",
            "permissions-required"
          ],
          "url": "https://community.silabs.com/068Vm00000x0yyH"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://www.ndss-symposium.org/ndss-paper/blerp-ble-re-pairing-attacks-and-defenses/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "forced re-pairing with already bonded device",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "030b2754-1501-44a4-bef8-48be86a33bf4",
    "assignerShortName": "Silabs",
    "cveId": "CVE-2026-16101",
    "datePublished": "2026-08-13T14:15:39.654Z",
    "dateReserved": "2026-07-17T14:36:03.677Z",
    "dateUpdated": "2026-08-13T17:01:15.389Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16076 (GCVE-0-2026-16076)

Vulnerability from cvelistv5 – Published: 2026-07-18 05:30 – Updated: 2026-07-20 19:10
VLAI
Title
AstrBotDevs AstrBot API open_api.py OpenApiRoute.chat_send authentication spoofing
Summary
A vulnerability has been found in AstrBotDevs AstrBot up to 4.25.5. This issue affects the function OpenApiRoute.chat_send of the file astrbot/dashboard/routes/open_api.py of the component API. Such manipulation of the argument Username leads to authentication bypass by spoofing. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
6.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 16:59 UTC
CWE
  • CWE-290 - Authentication Bypass by Spoofing
  • CWE-287 - Improper Authentication
Assigner
References
URL Tags
https://vuldb.com/vuln/379791 vdb-entrytechnical-description
https://vuldb.com/vuln/379791/cti signaturepermissions-required
https://vuldb.com/cve/CVE-2026-16076 third-party-advisory
https://vuldb.com/submit/852864 third-party-advisory
https://gist.github.com/YLChen-007/080ba55a71588d… exploit
Impacted products
Vendor Product Version
AstrBotDevs AstrBot Affected: 4.25.0
Affected: 4.25.1
Affected: 4.25.2
Affected: 4.25.3
Affected: 4.25.4
Affected: 4.25.5
    cpe:2.3:a:astrbot:astrbot:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Eric-d (VulDB User) VulDB CNA Team
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-16076",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-20T16:59:26.768141Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-20T19:10:52.910Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:astrbot:astrbot:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "API"
          ],
          "product": "AstrBot",
          "vendor": "AstrBotDevs",
          "versions": [
            {
              "status": "affected",
              "version": "4.25.0"
            },
            {
              "status": "affected",
              "version": "4.25.1"
            },
            {
              "status": "affected",
              "version": "4.25.2"
            },
            {
              "status": "affected",
              "version": "4.25.3"
            },
            {
              "status": "affected",
              "version": "4.25.4"
            },
            {
              "status": "affected",
              "version": "4.25.5"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Eric-d (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in AstrBotDevs AstrBot up to 4.25.5. This issue affects the function OpenApiRoute.chat_send of the file astrbot/dashboard/routes/open_api.py of the component API. Such manipulation of the argument Username leads to authentication bypass by spoofing. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T05:30:08.451Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-379791 | AstrBotDevs AstrBot API open_api.py OpenApiRoute.chat_send authentication spoofing",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/379791"
        },
        {
          "name": "VDB-379791 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/379791/cti"
        },
        {
          "name": "CVE-2026-16076 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-16076"
        },
        {
          "name": "Submit #852864 | AstrBotDevs AstrBot \u003c= 4.25.5 Authentication Bypass by Spoofing (CWE-290)",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/852864"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gist.github.com/YLChen-007/080ba55a71588dbbba3f27afed4c072c"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-17T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-07-17T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-07-17T15:45:44.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "AstrBotDevs AstrBot API open_api.py OpenApiRoute.chat_send authentication spoofing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-16076",
    "datePublished": "2026-07-18T05:30:08.451Z",
    "dateReserved": "2026-07-17T13:39:29.721Z",
    "dateUpdated": "2026-07-20T19:10:52.910Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15812 (GCVE-0-2026-15812)

Vulnerability from cvelistv5 – Published: 2026-07-21 05:09 – Updated: 2026-08-21 12:48
VLAI
Title
Kronosnet: kronosnet: access control list bypass via link id spoofing on unencrypted dynamic links
Summary
A vulnerability was found in the internal Access Control List (ACL) subsystem of kronosnet (Version affected: <= 1.34). When the framework is explicitly configured to manage dynamic links (accepting network traffic from any IP address) without network payload encryption, the validation architecture implicitly trusts the link ID provided within incoming data packets. A remote, unauthenticated attacker can exploit this lack of validation by spoofing a legitimate link ID inside crafted network frames. This allows the attacker to fully bypass the ACL framework and inject arbitrary data packets into the application layer, potentially leading to data corruption or service instabilities.
Severity
4.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-22 14:19 UTC
CWE
  • CWE-290 - Authentication Bypass by Spoofing
Assigner
References
URL Tags
https://access.redhat.com/security/cve/CVE-2026-15812 vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2500851 issue-trackingx_refsource_REDHAT
Impacted products
Date Public
2026-07-15 10:46
Credits
Red Hat would like to thank Fabio Di Nitto for reporting this issue.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15812",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T14:19:53.423425Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T14:20:07.617Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "kronosnet",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "kronosnet",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "kronosnet",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Fabio Di Nitto for reporting this issue."
        }
      ],
      "datePublic": "2026-07-15T10:46:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in the internal Access Control List (ACL) subsystem of kronosnet (Version affected: \u003c= 1.34). When the framework is explicitly configured to manage dynamic links (accepting network traffic from any IP address) without network payload encryption, the validation architecture implicitly trusts the link ID provided within incoming data packets. A remote, unauthenticated attacker can exploit this lack of validation by spoofing a legitimate link ID inside crafted network frames. This allows the attacker to fully bypass the ACL framework and inject arbitrary data packets into the application layer, potentially leading to data corruption or service instabilities."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Low"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T12:48:24.319Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-15812"
        },
        {
          "name": "RHBZ#2500851",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500851"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-15T10:43:28.380Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-15T10:46:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Kronosnet: kronosnet: access control list bypass via link id spoofing on unencrypted dynamic links",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-290: Authentication Bypass by Spoofing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-15812",
    "datePublished": "2026-07-21T05:09:48.164Z",
    "dateReserved": "2026-07-15T10:39:01.541Z",
    "dateUpdated": "2026-08-21T12:48:24.319Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-14450 (GCVE-0-2026-14450)

Vulnerability from cvelistv5 – Published: 2026-08-10 20:44 – Updated: 2026-08-27 15:06
VLAI
Title
Maas-billing: maas api: privilege escalation via forged http headers due to missing authentication
Summary
A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically `X-MaaS-Username` and `X-MaaS-Group`, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain unauthorized access and escalate privileges. The concrete consequences include the ability to mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, and exfiltrate sensitive model access configuration.
Severity
9.9 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 17:44 UTC
CWE
  • CWE-290 - Authentication Bypass by Spoofing
Assigner
References
URL Tags
https://access.redhat.com/errata/RHSA-2026:53262 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60520 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-14450 vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2496373 issue-trackingx_refsource_REDHAT
Impacted products
Vendor Product Version
Red Hat Red Hat OpenShift AI 3.4 Unaffected: 1785850409 , < * (rpm)
    cpe:/a:redhat:openshift_ai:3.4::el9
Create a notification for this product.
Red Hat Red Hat OpenShift AI 3.4 Unaffected: 1787153683 , < * (rpm)
    cpe:/a:redhat:openshift_ai:3.4::el9
Create a notification for this product.
Red Hat Red Hat OpenShift AI (RHOAI)     cpe:/a:redhat:openshift_ai
Create a notification for this product.
Date Public
2026-08-10 18:42
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-14450",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T17:44:30.745621Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T17:51:52.059Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_ai:3.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-maas-api-rhel9",
          "product": "Red Hat OpenShift AI 3.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1785850409",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_ai:3.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-maas-api-rhel9",
          "product": "Red Hat OpenShift AI 3.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1787153683",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_ai"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhoai/odh-maas-controller-rhel9",
          "product": "Red Hat OpenShift AI (RHOAI)",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_ai"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhoai/odh-mod-arch-maas-rhel9",
          "product": "Red Hat OpenShift AI (RHOAI)",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2026-08-10T18:42:25.268Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically `X-MaaS-Username` and `X-MaaS-Group`, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain unauthorized access and escalate privileges. The concrete consequences include the ability to mint Kubernetes ServiceAccount tokens in other tenants\u0027 namespaces, revoke API keys, and exfiltrate sensitive model access configuration."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T15:06:04.247Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:53262",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:53262"
        },
        {
          "name": "RHSA-2026:60520",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:60520"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-14450"
        },
        {
          "name": "RHBZ#2496373",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496373"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-02T07:18:50.042Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-08-10T18:42:25.268Z",
          "value": "Made public."
        }
      ],
      "title": "Maas-billing: maas api: privilege escalation via forged http headers due to missing authentication",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-290: Authentication Bypass by Spoofing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-14450",
    "datePublished": "2026-08-10T20:44:06.818Z",
    "dateReserved": "2026-07-02T07:39:29.182Z",
    "dateUpdated": "2026-08-27T15:06:04.247Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

No mitigation information available for this CWE.

CAPEC-21: Exploitation of Trusted Identifiers

An adversary guesses, obtains, or "rides" a trusted identifier (e.g. session ID, resource ID, cookie, etc.) to perform authorized actions under the guise of an authenticated user or service.

CAPEC-22: Exploiting Trust in Client

An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.

CAPEC-459: Creating a Rogue Certification Authority Certificate

An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.

CAPEC-461: Web Services API Signature Forgery Leveraging Hash Function Extension Weakness

An adversary utilizes a hash function extension/padding weakness, to modify the parameters passed to the web service requesting authentication by generating their own call in order to generate a legitimate signature hash (as described in the notes), without knowledge of the secret token sometimes provided by the web service.

CAPEC-473: Signature Spoof

An attacker generates a message or datablock that causes the recipient to believe that the message or datablock was generated and cryptographically signed by an authoritative or reputable source, misleading a victim or victim operating system into performing malicious actions.

CAPEC-476: Signature Spoofing by Misrepresentation

An attacker exploits a weakness in the parsing or display code of the recipient software to generate a data blob containing a supposedly valid signature, but the signer's identity is falsely represented, which can lead to the attacker manipulating the recipient software or its victim user to perform compromising actions.

CAPEC-59: Session Credential Falsification through Prediction

This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

CAPEC-60: Reusing Session IDs (aka Session Replay)

This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.

CAPEC-667: Bluetooth Impersonation AttackS (BIAS)

An adversary disguises the MAC address of their Bluetooth enabled device to one for which there exists an active and trusted connection and authenticates successfully. The adversary can then perform malicious actions on the target Bluetooth device depending on the target’s capabilities.

CAPEC-94: Adversary in the Middle (AiTM)

An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.

← Back to the CWE list