CVE-2026-110723

Proper unique identification and authentication of users directly stops spoofing-based bypass of authentication.

Device identification and authentication before connection prevents spoofing of devices to bypass auth.

Authenticator management ensures credentials cannot be easily spoofed or reused to bypass authentication.

Authentication of non-organizational users blocks external spoofing attempts against the scheme.

Input validation directly requires checking/neutralizing untrusted data such as HTTP headers before they reach browser components.

Proofing and binding identities reduces spoofing opportunities during enrollment but does not address runtime authentication implementation flaws.

Requiring authentication of users/services/hardware directly counters spoofing-based bypass when strong methods are used.

Protecting, conveying, and verifying identity assertions specifically prevents the spoofing that enables authentication bypass.

Secure SDLC practices directly require proper output encoding and header sanitization to prevent scripting injection.

A.5.15 only requires that an access control policy and requirements be defined and communicated; it does not itself implement, enforce or configure any authentication scheme that would stop spoofing attacks from bypassing authentication, so the weakness remains fully exploitable.

A.5.16 manages the lifecycle, uniqueness, and accountability of identities; it does not implement or strengthen authentication schemes against spoofing, so the CWE-290 exploit remains possible even when identities are correctly provisioned and tracked.

Authentication information management directly addresses credential handling that prevents spoofing.

A.5.18 governs the provisioning, review, and revocation of already-granted access rights to authenticated identities; it has no bearing on whether an authentication scheme can be spoofed or bypassed before any rights are assigned.