CWE-290


Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

We have discovered 945,946 live websites that are affected by CWE-290.

Contact us to get more info







CVEs

  • Count - 32



Website Distribution by Country

Number of websites using CWE-290
United States329,193 websites


British Virgin Islands244,643 websites
GB69,123 websites
Russia58,137 websites
Germany40,504 websites
France23,079 websites
China22,451 websites
Netherlands15,193 websites
Brazil12,180 websites
Czech Republic11,268 websites

Website Distribution by TLD

Number of websites using CWE-290
.com527,156 websites
.org62,060 websites
.ru49,837 websites
.net47,456 websites
.co.uk38,747 websites
.de15,224 websites
.com.br11,772 websites
.cn10,678 websites
.cz9,383 websites
.info8,308 websites

Newest CVEs

List of the most recent CVEs that are part of CWE-290
DiscoveredCVEDescriptionWebsites
Aug, 2026CVE-2026-73995 WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability6,869
Aug, 2026CVE-2026-28008 WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authentication vulnerability898
Aug, 2026CVE-2026-32469 WordPress CAPTCHA 4WP plugin <= 7.6.0 - Captcha Bypass vulnerability199
Aug, 2026CVE-2026-65502 WordPress Element Pack Elementor Addons plugin <= 8.7.13 - Captcha Bypass vulnerability13,784
Aug, 2026CVE-2026-65570 WordPress Login with phone number plugin <= 1.8.70 - Bypass vulnerability vulnerability55
Aug, 2026CVE-2026-14840 YOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofing9
Jul, 2026CVE-2026-13143 WP Travel < 11.8.1 - Unauthenticated Payment Bypass via Forged PayPal IPN858
Jul, 2026CVE-2026-62644 In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webm...7,956
Jun, 2026CVE-2026-25119 Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers39
Jun, 2026CVE-2026-42662 WordPress Event Tickets plugin <= 5.27.5 - Bypass Vulnerability vulnerability7,445

The most widespread CVEs

List of the most common CVEs that are part of CWE-290
DiscoveredCVEDescriptionWebsites
May, 2026CVE-2026-40460 NGINX ngx_quic_module vulnerability879,512
May, 2024CVE-2024-30522 WordPress Newsletter plugin <= 8.2.0 - IP Blacklist Bypass vulnerability16,353
Aug, 2026CVE-2026-65502 WordPress Element Pack Elementor Addons plugin <= 8.7.13 - Captcha Bypass vulnerability13,784
Jul, 2026CVE-2026-62644 In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webm...7,956
Jun, 2026CVE-2026-42662 WordPress Event Tickets plugin <= 5.27.5 - Bypass Vulnerability vulnerability7,445
Mar, 2023CVE-2023-0816 Formidable Forms < 6.1 - IP Spoofing7,188
Aug, 2026CVE-2026-73995 WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability6,869
May, 2024CVE-2024-3050 Site Reviews < 7.0.0 - IP Spoofing2,134
Aug, 2023CVE-2022-1601 User Access Manager < 2.2.18 - IP Spoofing1,763
Aug, 2026CVE-2026-28008 WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authentication vulnerability898

Websites affected by CWE-290

Top websites that are affected by CWE-290. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*****.org United States***
******.com British Virgin Islands***
****.*********.com British Virgin Islands***
********.**************.com United States***
**************.******.com United States*,***
*.cn China*,***
****.***********.pl Poland*,***
**.*********.com British Virgin Islands*,***
**.*********.com British Virgin Islands*,***
**.*********.com British Virgin Islands*,***
See full domain list