CWE-290 使用欺骗进行的认证绕过 类弱点 401 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-290 是一种身份验证绕过漏洞，源于身份验证机制实现不当，易受欺骗攻击。攻击者通常通过伪造或篡改身份标识（如IP地址、证书或令牌），使系统误认其为合法用户从而获取未授权访问权限。开发者应实施强身份验证策略，包括多因素认证、严格的输入验证及防重放机制，并定期审查认证逻辑，确保身份源的可信性与完整性，以有效防御此类欺骗行为。
String sourceIP = request.getRemoteAddr(); if (sourceIP != null && sourceIP.equals(APPROVED_IP)) { authenticated = true; }sd = socket(AF_INET, SOCK_DGRAM, 0); serv.sin_family = AF_INET; serv.sin_addr.s_addr = htonl(INADDR_ANY); servr.sin_port = htons(1008); bind(sd, (struct sockaddr *) & serv, sizeof(serv)); while (1) { memset(msg, 0x0, MAX_MSG); clilen = sizeof(cli); if (inet_ntoa(cli.sin_addr)==getTrustedAddress()) { n = recvfrom(sd, msg, MAX_MSG, 0, (struct sockaddr *) & cli, &clilen); } }while(true) { DatagramPacket rp=new DatagramPacket(rData,rData.length); outSock.receive(rp); String in = new String(p.getData(),0, rp.getLength()); InetAddress clientIPAddress = rp.getAddress(); int port = rp.getPort(); if (isTrustedAddress(clientIPAddress) & secretKey.equals(in)) { out = secret.getBytes(); DatagramPacket sp =new DatagramPacket(out,out.length, IPAddress, port); outSock.send(sp); } }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-101280 | OpenDMARC 认证欺骗漏洞 — OpenDMARC | 7.3 | High | 2026-09-29 |
| CVE-2026-93538 | Fleet 集群标签伪造致跨租户机密泄露漏洞 — Rancher | 7.1 | High | 2026-09-28 |
| CVE-2026-100390 | Zoraxy 3.2.3-3.3.4 客户端IP欺骗漏洞 — zoraxy | 7.4 | High | 2026-09-25 |
| CVE-2026-84465 | Zammad S/MIME签名验证存在伪造发件人漏洞 — zammad | 7.1 | High | 2026-09-25 |
| CVE-2026-94416 | aap-gateway 通过伪造工作负载身份令牌绕过授权漏洞 — Red Hat Ansible Automation Platform 2 | 6.8 | Medium | 2026-09-24 |
| CVE-2026-95524 | WordPress WP User Frontend 4.3.11 权限绕过漏洞 — WP User Frontend | 5.3 | Medium | 2026-09-23 |
| CVE-2026-95523 | WordPress WP User Frontend 4.3.11 绕过漏洞 — WP User Frontend | 6.5 | Medium | 2026-09-23 |
| CVE-2026-94457 | WordPress Captcha Code插件3.32之前版本绕过漏洞 — Captcha Code | 4.8 | Medium | 2026-09-23 |
| CVE-2026-92929 | OpenEye Apex NVR 3.2.9.376 XFF伪造绕过漏洞 — Apex Network Video Recorder (NVR) | 5.3 | Medium | 2026-09-22 |
| CVE-2026-55210 | Joplin SSO登录逻辑缺陷致账户接管漏洞 — joplin | 7.4 | High | 2026-09-21 |
| CVE-2026-62987 | Fabio 4.1.1 请求头伪造漏洞 — fabio | 5.8 | Medium | 2026-09-21 |
| CVE-2026-85751 | Mailu 通过X-Forwarded-By头伪造致认证绕过漏洞 — Mailu | 9.8 | Critical | 2026-09-21 |
| CVE-2026-61682 | kcp front-proxy 身份伪造漏洞 — kcp | 9.9 | Critical | 2026-09-18 |
| CVE-2026-85511 | Wildfly Elytron OAuth2 令牌参数注入漏洞 — Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 | 4.2 | Medium | 2026-09-18 |
| CVE-2026-69843 | Microsoft Fabric 权限提升漏洞 — Microsoft Fabric | 10.0 | Critical | 2026-09-17 |
| CVE-2026-77903 | Microsoft Dataverse 权限提升漏洞 — Microsoft Dataverse | 9.0 | Critical | 2026-09-17 |
| CVE-2026-76949 | ash_authentication 会话替换漏洞 — ash_authentication | 9.1 | Critical | 2026-09-17 |
| CVE-2026-86863 | pgAdmin 4 Web服务器身份验证绕过漏洞 — pgAdmin 4 | 9.8 | Critical | 2026-09-17 |
| CVE-2026-91039 | ash_authentication 动态 OIDC 跨连接账户接管漏洞 — ash_authentication | 9.1 | Critical | 2026-09-17 |
| CVE-2026-86039 | libp2p PeerStore 恶意对等记录存储漏洞 — js-libp2p | 8.2 | High | 2026-09-17 |
| CVE-2026-62108 | WordPress Headless Single Sign On 1.7.0 认证失效漏洞 — Headless Single Sign On | 9.8 | Critical | 2026-09-17 |
| CVE-2026-20071 | ISE 802.1x会话劫持漏洞 — Cisco Identity Services Engine Software | 3.8 | Low | 2026-09-16 |
| CVE-2026-76423 | Cisco ISE API认证绕过漏洞 — Cisco Identity Services Engine Software | 10.0 | Critical | 2026-09-16 |
| CVE-2026-92395 | fastify/proxy-addr IPv6映射IPv4 IP欺骗漏洞 — @fastify/proxy-addr | 9.1 | Critical | 2026-09-16 |
| CVE-2026-40854 | T-Mobile 5G Box IDU 路由器会话认证绕过漏洞 — T-Mobile 5G Box IDU | 8.7 | High | 2026-09-16 |
| CVE-2026-15640 | SAML响应篡改导致的认证绕过漏洞 — Secret Server (On-Prem) | 9.5 | Critical | 2026-09-15 |
| CVE-2026-89022 | BookStack 26.05.5 前社交登录认证绕过漏洞 — bookstack | 7.4 | High | 2026-09-15 |
| CVE-2026-59157 | webhookd 无限制HTTP头至Shell变量注入漏洞 — webhookd | 6.5 | Medium | 2026-09-15 |
| CVE-2026-90711 | proxy-addr IP欺骗漏洞 — proxy-addr | 9.1 | Critical | 2026-09-15 |
| CVE-2026-73449 | Arista Networks EOS 授权问题漏洞 — EOS | 5.9 | Medium | 2026-09-14 |
CWE-290（使用欺骗进行的认证绕过） 是常见的弱点类别，本平台收录该类弱点关联的 401 条 CVE 漏洞。