CVE-2026-102946

Directly counters DNS response spoofing by requiring cryptographic origin authentication artifacts from the authoritative source.

Directly counters DNS response spoofing by requiring cryptographic origin authentication before trusting resolved names/addresses.

PKI certificates under an approved policy require cryptographic signature verification on issuance and validation.

Mandates verification of data authenticity for software, firmware, and information.

Reveals spoofed logon attempts through unexpected previous logon timestamps upon legitimate login.

Training specifically addresses recognizing spoofed communications and phishing that enable authentication bypass.

Requires verification of digital signatures using organization-approved certificates before installation, directly preventing improper verification of cryptographic signatures.

Requiring verifiable identity evidence at appropriate assurance levels makes it substantially harder for attackers to successfully spoof or impersonate users to obtain accounts.

Requires assessing authenticity and integrity of acquired assets, which commonly relies on signature verification but is limited to pre-acquisition.

Proofing and binding identities reduces spoofing opportunities during enrollment but does not address runtime authentication implementation flaws.

Requiring authentication of users/services/hardware directly counters spoofing-based bypass when strong methods are used.

Protecting, conveying, and verifying identity assertions specifically prevents the spoofing that enables authentication bypass.

Digital signatures are explicitly cited to protect integrity of data-at-rest, so proper verification directly mitigates the weakness.

Digital signatures are explicitly cited to protect integrity of data-in-transit, so proper verification directly mitigates the weakness.

A.5.15 only requires that an access control policy and requirements be defined and communicated; it does not itself implement, enforce or configure any authentication scheme that would stop spoofing attacks from bypassing authentication, so the weakness remains fully exploitable.

A.5.16 manages the lifecycle, uniqueness, and accountability of identities; it does not implement or strengthen authentication schemes against spoofing, so the CWE-290 exploit remains possible even when identities are correctly provisioned and tracked.

Authentication information management directly addresses credential handling that prevents spoofing.

A.5.18 governs the provisioning, review, and revocation of already-granted access rights to authenticated identities; it has no bearing on whether an authentication scheme can be spoofed or bypassed before any rights are assigned.