Statamic CMS versions prior to 5.74.1 and 6.24.0 contain an improper authentication vulnerability when OAuth login is enabled with providers that do not guarantee verified email addresses. This flaw allows an unauthenticated attacker to sign in as an existing user, including potentially a super admin, without knowing the user's password. The vulnerability arises because the application matches OAuth identities to user accounts solely by email address. This issue is fixed in versions 5.74.1 and 6.24.0.
CVE-2026-65570 is an authentication bypass vulnerability affecting the 'Login with phone number' product by Hamid Alinia in versions up to and including 1.8.70. This vulnerability allows unauthenticated attackers to bypass authentication mechanisms by spoofing, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability is classified under CWE-290 (Authentication Bypass by Spoofing) and has a high severity with a CVSS score of 8.1. No official patch or remediation guidance has been provided yet.
CVE-2026-65502 is an authentication bypass vulnerability affecting Element Pack Elementor Addons versions up to and including 8.7.13. This flaw allows unauthenticated attackers to bypass authentication controls by spoofing, potentially leading to unauthorized actions. The vulnerability has a medium severity with a CVSS score of 5.3. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-32469 is an authentication bypass vulnerability affecting CAPTCHA 4WP versions up to and including 7.6.0. This flaw allows unauthenticated attackers to bypass CAPTCHA protections by spoofing, potentially enabling actions that require CAPTCHA verification to be performed without proper validation. The vulnerability is classified under CWE-290 (Authentication Bypass by Spoofing). The CVSS 3.1 base score is 5.3, indicating a medium severity level. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-48063 is a critical authentication bypass vulnerability in WhiskeySockets Baileys, a socket-based TypeScript/JavaScript API for WhatsApp Web. Versions prior to 6.7.22 and 7.0.0-rc12 allow an attacker to send malicious payloads that spoof messages, corrupt app state synchronization, and inject fake message history. This vulnerability enables attackers to impersonate messages and manipulate synchronization contexts. The issue has been fixed in versions 6.7.22 and 7.0.0-rc12.
The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll.
CVE-2026-13143 is a medium severity vulnerability in the WP Travel WordPress plugin before version 11.8.1. The plugin fails to verify PayPal Instant Payment Notifications (IPNs) through the required PayPal post-back handshake. This flaw allows unauthenticated attackers to spoof payment notifications, causing arbitrary pending bookings to be marked as paid with attacker-chosen amounts.
CVE-2026-11870 is a medium severity vulnerability in the WP Ghost (Hide My WP Ghost) WordPress plugin before version 7.0.05. The plugin fails to verify that client IP information originates from a trusted proxy before trusting HTTP headers that can be controlled by an attacker. This allows unauthenticated attackers to spoof their IP address, bypassing the plugin's brute-force protection and downgrading its firewall by matching a hardcoded whitelisted IP range.
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers and before invoking AdminOnlyWithRedirect. An attacker with a valid x-cstln-auth API key for an enrolled device who reaches Cosmos through the Constellation Nebula tunnel can supply a chosen x-cosmos-user value to a route with AuthEnabled enabled when the upstream application trusts that forward-auth header. The request can bypass Cosmos JWT, password, MFA, and AdminOnly checks, allowing user impersonation and admin-tier reads or writes exposed by the proxied application. This issue is fixed in version 0.22.19.
A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the `POST /api/v1/login` and self password-change endpoints by rotating the `X-Forwarded-For` header. The rate limiter keys requests by `request.client.host`, which is derived from the `X-Forwarded-For` header when Uvicorn is launched with `--proxy-headers --forwarded-allow-ips *`. This configuration allows clients to control the value of `request.client.host`, effectively bypassing rate-limiting protections. This vulnerability leaves the affected endpoints open to unthrottled credential guessing attacks.
Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension - GeoIP lookups trusted spoofable forwarded client-IP headers, this could cause GeoIP-rule bypass.
Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate mapped accounts.
In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. One server cookie obtained through a given proxy node therefore validates for every PROXYv2-declared source behind that node. On a UDP+proxy-protocol front, an off-path attacker can harvest one cookie with a single legitimate query, then replay it under any spoofed source and pass DNS Cookie checks that were deployed to defeat this in the first place.
CVE-2026-50755 is a critical vulnerability in DayuanJiang next-ai-draw-io version 0.4.13 that allows a remote attacker to obtain sensitive information by manipulating the X-Forwarded-For header value.
A vulnerability has been found in AstrBotDevs AstrBot up to 4.25.5. This issue affects the function OpenApiRoute.chat_send of the file astrbot/dashboard/routes/open_api.py of the component API. Such manipulation of the argument Username leads to authentication bypass by spoofing. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization by exploiting the mutable display name binding in the affected feature.
9Router is an AI router & token saver. In 0.4.45 and earlier, 9Router's src/dashboardGuard.js local-only access gate used Host and Origin headers in isLocalRequest() to protect /api/mcp/*, /api/tunnel/*, and /api/cli-tools/*, allowing header spoofing in reverse proxy or tunnel deployments to reach MCP child process stdin paths.
A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed Subject header matching a legitimate client certificate DN to bypass mTLS authentication and inject arbitrary events into protected EDA event streams.