CVE-2026-105863

Enforces authorizations so that only permitted attributes may be modified on an object.

Limits the set of modifiable attributes a subject is authorized to touch.

Proper unique identification and authentication of users directly stops spoofing-based bypass of authentication.

Device identification and authentication before connection prevents spoofing of devices to bypass auth.

Authenticator management ensures credentials cannot be easily spoofed or reused to bypass authentication.

Authentication of non-organizational users blocks external spoofing attempts against the scheme.

Proofing and binding identities reduces spoofing opportunities during enrollment but does not address runtime authentication implementation flaws.

Requiring authentication of users/services/hardware directly counters spoofing-based bypass when strong methods are used.

Protecting, conveying, and verifying identity assertions specifically prevents the spoofing that enables authentication bypass.

Secure SDLC practices directly require allow-listing of mutable object attributes and input validation to block mass-assignment flaws.

A.5.15 only requires that an access control policy and requirements be defined and communicated; it does not itself implement, enforce or configure any authentication scheme that would stop spoofing attacks from bypassing authentication, so the weakness remains fully exploitable.

A.5.16 manages the lifecycle, uniqueness, and accountability of identities; it does not implement or strengthen authentication schemes against spoofing, so the CWE-290 exploit remains possible even when identities are correctly provisioned and tracked.

Authentication information management directly addresses credential handling that prevents spoofing.

A.5.18 governs the provisioning, review, and revocation of already-granted access rights to authenticated identities; it has no bearing on whether an authentication scheme can be spoofed or bypassed before any rights are assigned.