Security Resilience

CWE · MITRE source

CWE-290Authentication Bypass by Spoofing

Abstraction: Base · CVEs in our corpus: 795

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Last updated: 16 October 2026 00:29 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 5 mapping(s) from 4 framework(s): ATT&CK 2 (partial) · STIG oracle linux 8 1 (mostly) · STIG rhel 7 1 (mostly) · STIG rhel 8 1 (mostly)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A07:2025 Authentication Failures.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • SC-11 Trusted Path
  • SC-20 Secure Name/Address Resolution Service (Authoritative Source)
  • SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
  • SC-23 Session Authenticity
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)
  • 3 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V6.4.3
  • V10.4.16
  • V11.4.3

NIST 800-53 r5 controls PROPOSED for this weakness (11)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Showing the 8 most specific. Generic controls that address many weakness types are collapsed below.

Control Title Family Why it addresses this CWE
IA-3Device Identification and AuthenticationIAgraded full Unique device authentication makes successful spoofing of device identity substantially more difficult to achieve.
IA-8Identification and Authentication (Non-organizational Users)IAgraded full Unique identification of non-organizational users reduces the feasibility of authentication bypass by spoofing.
SC-11Trusted PathSCIsolated trusted path ensures the user interacts only with genuine system components, preventing spoofing of authentication interfaces or prompts.
SC-20Secure Name/Address Resolution Service (Authoritative Source)SCDirectly counters DNS response spoofing by requiring cryptographic origin authentication artifacts from the authoritative source.
SC-21Secure Name/Address Resolution Service (Recursive or Caching Resolver)SCDirectly counters DNS response spoofing by requiring cryptographic origin authentication before trusting resolved names/addresses.
IA-12Identity ProofingIARequiring verifiable identity evidence at appropriate assurance levels makes it substantially harder for attackers to successfully spoof or impersonate users to obtain accounts.
AC-9Previous Logon NotificationACReveals spoofed logon attempts through unexpected previous logon timestamps upon legitimate login.
AT-2Literacy Training and AwarenessATTraining specifically addresses recognizing spoofed communications and phishing that enable authentication bypass.
Show 3 more broadly-applicable controls
SC-23Session AuthenticitySCRequires cryptographic or protocol-level verification that blocks spoofed session establishment or continuation.
SC-40Wireless Link ProtectionSCSignal-parameter protections (e.g., cryptographic authentication, anti-spoofing) directly counter spoofing-based authentication bypass.
IA-9Service Identification and AuthenticationIAUnique identification and authentication of services before communications makes spoofing of service identities substantially harder.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2022-24112 KEV 9.99.80.96072022-02-11
CVE-2024-4358 KEV 9.99.80.97482024-05-29
CVE-2024-54085 KEV 9.99.80.60752025-03-11
CVE-2020-7388 9.810.00.69442021-07-22
CVE-2022-23131 KEV 9.59.10.95682022-01-13
CVE-2021-34646 9.49.80.50872021-08-30
CVE-2025-49002 9.39.80.49992025-06-03
CVE-2026-104935 KEV9.28.60.25982026-10-13
CVE-2018-7842 9.09.80.35042019-05-22
CVE-2021-29441 8.88.60.83482021-04-27
CVE-2023-30803 8.69.80.20892023-10-10
CVE-2019-1234 8.47.50.75192019-11-12
CVE-2018-5353 8.29.80.11152020-09-30
CVE-2022-3180 8.29.80.09212025-02-11
CVE-2009-1048 8.09.80.06372009-08-14
CVE-2019-16871 8.09.80.05302019-12-19
CVE-2017-14375 7.99.80.04772017-11-01
CVE-2025-32966 7.99.80.04452025-04-23
CVE-2018-15715 7.89.80.03492018-11-30
CVE-2020-26276 7.810.00.02202020-12-17
CVE-2020-22001 7.89.80.03412021-04-27
CVE-2022-29165 7.810.00.02092022-05-20
CVE-2025-69258 7.89.80.03572026-01-08
CVE-2026-49468 7.89.80.03032026-06-22
CVE-2017-14003 7.79.80.02602017-10-11