CWE-290 使用欺骗进行的认证绕过 类弱点 315 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-290 是一种身份验证绕过漏洞，源于身份验证机制实现不当，易受欺骗攻击。攻击者通常通过伪造或篡改身份标识（如IP地址、证书或令牌），使系统误认其为合法用户从而获取未授权访问权限。开发者应实施强身份验证策略，包括多因素认证、严格的输入验证及防重放机制，并定期审查认证逻辑，确保身份源的可信性与完整性，以有效防御此类欺骗行为。
String sourceIP = request.getRemoteAddr(); if (sourceIP != null && sourceIP.equals(APPROVED_IP)) { authenticated = true; }sd = socket(AF_INET, SOCK_DGRAM, 0); serv.sin_family = AF_INET; serv.sin_addr.s_addr = htonl(INADDR_ANY); servr.sin_port = htons(1008); bind(sd, (struct sockaddr *) & serv, sizeof(serv)); while (1) { memset(msg, 0x0, MAX_MSG); clilen = sizeof(cli); if (inet_ntoa(cli.sin_addr)==getTrustedAddress()) { n = recvfrom(sd, msg, MAX_MSG, 0, (struct sockaddr *) & cli, &clilen); } }while(true) { DatagramPacket rp=new DatagramPacket(rData,rData.length); outSock.receive(rp); String in = new String(p.getData(),0, rp.getLength()); InetAddress clientIPAddress = rp.getAddress(); int port = rp.getPort(); if (isTrustedAddress(clientIPAddress) & secretKey.equals(in)) { out = secret.getBytes(); DatagramPacket sp =new DatagramPacket(out,out.length, IPAddress, port); outSock.send(sp); } }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-65570 | WordPress 手机号登录插件 <=1.8.70 绕过漏洞 — Login with phone number | 8.1 | High | 2026-08-06 |
| CVE-2026-65502 | WordPress Element Pack 8.7.13 及以下版本验证码绕过漏洞 — Element Pack Elementor Addons | 5.3 | Medium | 2026-08-06 |
| CVE-2026-32469 | WordPress CAPTCHA 4WP <= 7.6.0 验证码绕过漏洞 — CAPTCHA 4WP | 5.3 | Medium | 2026-08-06 |
| CVE-2026-48063 | WhiskeySockets Baileys 授权问题漏洞 — Baileys | 9.3 | Critical | 2026-08-03 |
| CVE-2026-11922 | ZenML 授权问题漏洞 — zenml-io/zenml | - | - | 2026-07-24 |
| CVE-2026-64875 | joomla GeoIP 授权问题漏洞 — GeoIP extension for Joomla | - | - | 2026-07-23 |
| CVE-2026-64797 | joomla IP Login 授权问题漏洞 — IP Login extension for Joomla | - | - | 2026-07-22 |
| CVE-2026-63683 | joomla Advanced Module Manager 授权问题漏洞 — Advanced Module Manager extension for Joomla | - | - | 2026-07-22 |
| CVE-2026-54478 | NLnet Labs Unbound 授权问题漏洞 — Unbound | 3.7 | Low | 2026-07-22 |
| CVE-2026-3183 | ZOHO ManageEngine ADSelfService Plus 授权问题漏洞 — ManageEngine ADSelfService Plus | 7.1 | High | 2026-07-21 |
| CVE-2026-15812 | Kronosnet 授权问题漏洞 — Red Hat Enterprise Linux 10 | 4.8 | Medium | 2026-07-21 |
| CVE-2026-16076 | AstrBot 授权问题漏洞 — AstrBot | 6.3 | Medium | 2026-07-18 |
| CVE-2026-62224 | OpenClaw MS Teams 授权问题漏洞 — msteams | 5.4 | Medium | 2026-07-17 |
| CVE-2026-49353 | decolua 9router 授权问题漏洞 — 9router | 7.5 | High | 2026-07-15 |
| CVE-2026-12382 | Red Hat Ansible Automation Platform 授权问题漏洞 — Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 8.2 | High | 2026-07-15 |
| CVE-2026-47737 | Puma 授权问题漏洞 — puma | 7.5 | High | 2026-07-14 |
| CVE-2026-45063 | Symfony 授权问题漏洞 — symfony | - | - | 2026-07-14 |
| CVE-2026-45074 | Symfony 授权问题漏洞 — symfony | - | - | 2026-07-14 |
| CVE-2026-62644 | Roundcube webmail 授权问题漏洞 — Webmail | 6.4 | Medium | 2026-07-14 |
| CVE-2026-55954 | Ueberauth Apple 授权问题漏洞 — ueberauth_apple | - | - | 2026-07-14 |
| CVE-2026-58488 | HedgeDoc 授权问题漏洞 — hedgedoc | - | - | 2026-07-13 |
| CVE-2026-61428 | Mervin Praison PraisonAI 授权问题漏洞 — PraisonAI | 7.3 | High | 2026-07-11 |
| CVE-2026-55641 | decolua 9router 配置错误漏洞 — 9router | 8.2 | High | 2026-07-10 |
| CVE-2026-54782 | CoreWCF 授权问题漏洞 — CoreWCF | 10.0 | Critical | 2026-07-08 |
| CVE-2026-8651 | Progress MOVEit Transfer 授权问题漏洞 — MOVEit Transfer | 3.7 | Low | 2026-07-08 |
| CVE-2026-45045 | Fiber 授权问题漏洞 — fiber | 5.3 | Medium | 2026-07-08 |
| CVE-2026-56360 | n8n 授权问题漏洞 — n8n | 4.0 | Medium | 2026-07-08 |
| CVE-2026-24013 | Apache IoTDB 授权问题漏洞 — Apache IoTDB | - | - | 2026-07-06 |
| CVE-2026-24270 | NVIDIA AIStore framework 授权问题漏洞 — AIStore framework | 9.8 | Critical | 2026-07-01 |
| CVE-2026-13207 | frangoteam FUXA 授权问题漏洞 — FUXA SCADA/HMI | 7.5 | High | 2026-06-30 |
CWE-290（使用欺骗进行的认证绕过） 是常见的弱点类别，本平台收录该类弱点关联的 315 条 CVE 漏洞。