Cyber Resilience

CWE · MITRE source

CWE-290Authentication Bypass by Spoofing

Abstraction: Base · CVEs in our corpus: 667

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Last updated: 21 August 2026 00:24 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 15 mapping(s) from 5 framework(s): CAPEC 10 (partial) · ATT&CK 2 (partial) · STIG oracle linux 8 1 (mostly) · STIG rhel 7 1 (mostly) · STIG rhel 8 1 (mostly)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A07:2025 Authentication Failures.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • SC-11 Trusted Path
  • SC-20 Secure Name/Address Resolution Service (Authoritative Source)
  • SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
  • SC-23 Session Authenticity
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)
  • 3 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V6.4.3
  • V10.4.16
  • V10.5.1
  • V11.4.3

NIST 800-53 r5 controls that address this weakness (11)AI-assisted

Showing the 8 most specific. Generic controls that address many weakness types are collapsed below.

Control Title Family Why it addresses this CWE
SC-11Trusted PathSCIsolated trusted path ensures the user interacts only with genuine system components, preventing spoofing of authentication interfaces or prompts.
SC-20Secure Name/Address Resolution Service (Authoritative Source)SCDirectly counters DNS response spoofing by requiring cryptographic origin authentication artifacts from the authoritative source.
SC-21Secure Name/Address Resolution Service (Recursive or Caching Resolver)SCDirectly counters DNS response spoofing by requiring cryptographic origin authentication before trusting resolved names/addresses.
IA-12Identity ProofingIARequiring verifiable identity evidence at appropriate assurance levels makes it substantially harder for attackers to successfully spoof or impersonate users to obtain accounts.
IA-3Device Identification and AuthenticationIAUnique device authentication makes successful spoofing of device identity substantially more difficult to achieve.
IA-8Identification and Authentication (Non-organizational Users)IAUnique identification of non-organizational users reduces the feasibility of authentication bypass by spoofing.
AC-9Previous Logon NotificationACReveals spoofed logon attempts through unexpected previous logon timestamps upon legitimate login.
AT-2Literacy Training and AwarenessATTraining specifically addresses recognizing spoofed communications and phishing that enable authentication bypass.
Show 3 more broadly-applicable controls
SC-23Session AuthenticitySCRequires cryptographic or protocol-level verification that blocks spoofed session establishment or continuation.
SC-40Wireless Link ProtectionSCSignal-parameter protections (e.g., cryptographic authentication, anti-spoofing) directly counter spoofing-based authentication bypass.
IA-9Service Identification and AuthenticationIAUnique identification and authentication of services before communications makes spoofing of service identities substantially harder.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1036.001 Invalid Code Signature←PT1550.004 Web Session Cookie←P →P

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2022-24112 KEV 9.99.80.96002022-02-11
CVE-2024-4358 KEV 9.99.80.97482024-05-29
CVE-2024-54085 KEV 9.99.80.60832025-03-11
CVE-2020-7388 9.810.00.69442021-07-22
CVE-2022-23131 KEV 9.59.10.95682022-01-13
CVE-2021-34646 9.49.80.50872021-08-30
CVE-2025-49002 9.29.80.45022025-06-03
CVE-2018-7842 9.09.80.35042019-05-22
CVE-2021-29441 8.78.60.69632021-04-27
CVE-2023-30803 8.59.80.18212023-10-10
CVE-2019-1234 8.47.50.73742019-11-12
CVE-2018-5353 8.29.80.11062020-09-30
CVE-2022-3180 8.29.80.09212025-02-11
CVE-2009-1048 8.09.80.06372009-08-14
CVE-2019-16871 8.09.80.05302019-12-19
CVE-2017-14375 7.99.80.04772017-11-01
CVE-2025-32966 7.99.80.04402025-04-23
CVE-2018-15715 7.89.80.03492018-11-30
CVE-2020-26276 7.810.00.02172020-12-17
CVE-2020-22001 7.89.80.03412021-04-27
CVE-2025-69258 7.89.80.03532026-01-08
CVE-2017-14003 7.79.80.02602017-10-11
CVE-2019-16378 7.79.80.02462019-09-17
CVE-2019-18259 7.79.80.02112019-12-16
CVE-2019-20790 7.79.80.02552020-04-27