CWE-290
AllowedAuthentication Bypass by Spoofing
Abstraction: Base · Status: Incomplete
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
1108 vulnerabilities reference this CWE, most recent first.
GHSA-F5WH-76C3-V562
Vulnerability from github – Published: 2024-06-04 15:30 – Updated: 2024-06-04 15:30Authentication Bypass by Spoofing vulnerability in WPMU DEV Branda allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Branda: from n/a through 3.4.14.
{
"affected": [],
"aliases": [
"CVE-2023-51542"
],
"database_specific": {
"cwe_ids": [
"CWE-290"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-04T13:15:49Z",
"severity": "MODERATE"
},
"details": "Authentication Bypass by Spoofing vulnerability in WPMU DEV Branda allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Branda: from n/a through 3.4.14.",
"id": "GHSA-f5wh-76c3-v562",
"modified": "2024-06-04T15:30:57Z",
"published": "2024-06-04T15:30:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51542"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/branda-white-labeling/wordpress-branda-plugin-3-4-14-ip-restriction-bypass-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F632-C3RH-R2V2
Vulnerability from github – Published: 2024-05-07 18:30 – Updated: 2026-05-12 12:31An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This could lead to the GDBus-based client behaving incorrectly, with an application-dependent impact.
{
"affected": [],
"aliases": [
"CVE-2024-34397"
],
"database_specific": {
"cwe_ids": [
"CWE-290"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-07T18:15:08Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This could lead to the GDBus-based client behaving incorrectly, with an application-dependent impact.",
"id": "GHSA-f632-c3rh-r2v2",
"modified": "2026-05-12T12:31:45Z",
"published": "2024-05-07T18:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34397"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3268"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/05/msg00008.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IRSFYAE5X23TNRWX7ZWEJOMISLCDSYNS"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LCDY3KA7G7D3DRXYTT46K6LFHS2KHWBH"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LL6HSJDXCXMLEIJBYV6CPOR4K2NTCTXW"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UNFJHISR4O6VFOHBFWH5I5WWMG37H63A"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IRSFYAE5X23TNRWX7ZWEJOMISLCDSYNS"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LCDY3KA7G7D3DRXYTT46K6LFHS2KHWBH"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LL6HSJDXCXMLEIJBYV6CPOR4K2NTCTXW"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UNFJHISR4O6VFOHBFWH5I5WWMG37H63A"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240531-0008"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2024/05/07/5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-F6R7-5VGC-Q2JP
Vulnerability from github – Published: 2022-07-09 00:00 – Updated: 2022-07-17 00:00IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.7 and Open Liberty are vulnerable to identity spoofing by an authenticated user using a specially crafted request. IBM X-Force ID: 225604.
{
"affected": [],
"aliases": [
"CVE-2022-22476"
],
"database_specific": {
"cwe_ids": [
"CWE-290"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-08T18:15:00Z",
"severity": "HIGH"
},
"details": "IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.7 and Open Liberty are vulnerable to identity spoofing by an authenticated user using a specially crafted request. IBM X-Force ID: 225604.",
"id": "GHSA-f6r7-5vgc-q2jp",
"modified": "2022-07-17T00:00:47Z",
"published": "2022-07-09T00:00:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22476"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/225604"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6602015"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F74P-MFVV-MM55
Vulnerability from github – Published: 2025-08-08 15:30 – Updated: 2025-08-08 15:30IBM i 7.3, 7.4, 7.5, and 7.6 is affected by an authenticated user obtaining elevated privileges with IBM Digital Certificate Manager for i (DCM) due to a web session hijacking vulnerability. An authenticated user without administrator privileges could exploit this vulnerability to perform actions in DCM as an administrator.
{
"affected": [],
"aliases": [
"CVE-2025-36119"
],
"database_specific": {
"cwe_ids": [
"CWE-290"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-08T15:15:28Z",
"severity": "HIGH"
},
"details": "IBM i 7.3, 7.4, 7.5, and 7.6 is affected by an authenticated user obtaining elevated privileges with IBM Digital Certificate Manager for i (DCM) due to a web session hijacking vulnerability. An authenticated user without administrator privileges could exploit this vulnerability to perform actions in DCM as an administrator.",
"id": "GHSA-f74p-mfvv-mm55",
"modified": "2025-08-08T15:30:34Z",
"published": "2025-08-08T15:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36119"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7241008"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-F7QM-MCG6-FHVG
Vulnerability from github – Published: 2024-10-23 18:33 – Updated: 2024-10-23 18:33A vulnerability in the AnyConnect firewall for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access control list (ACL) and allow traffic that should have been denied to flow through an affected device. This vulnerability is due to a logic error in populating group ACLs when an AnyConnect client establishes a new session toward an affected device. An attacker could exploit this vulnerability by establishing an AnyConnect connection to the affected device. A successful exploit could allow the attacker to bypass configured ACL rules.
{
"affected": [],
"aliases": [
"CVE-2024-20299"
],
"database_specific": {
"cwe_ids": [
"CWE-290"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-23T17:15:16Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the AnyConnect firewall for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access control list (ACL) and allow traffic that should have been denied to flow through an affected device. This vulnerability is due to a logic error in populating group ACLs when an AnyConnect client establishes a new session toward an affected device. An attacker could exploit this vulnerability by establishing an AnyConnect connection to the affected device. A successful exploit could allow the attacker to bypass configured ACL rules.",
"id": "GHSA-f7qm-mcg6-fhvg",
"modified": "2024-10-23T18:33:08Z",
"published": "2024-10-23T18:33:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20299"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-acl-bypass-VvnLNKqf"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-M446vbEO"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75300"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F8W4-9VP9-7V2Q
Vulnerability from github – Published: 2026-02-23 21:31 – Updated: 2026-02-25 15:31Improper session management in GCOM EPON 1GE ONU version C00R371V00B01 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user.
{
"affected": [],
"aliases": [
"CVE-2025-71056"
],
"database_specific": {
"cwe_ids": [
"CWE-290"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-23T21:19:09Z",
"severity": "CRITICAL"
},
"details": "Improper session management in GCOM EPON 1GE ONU version C00R371V00B01 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user.",
"id": "GHSA-f8w4-9vp9-7v2q",
"modified": "2026-02-25T15:31:37Z",
"published": "2026-02-23T21:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71056"
},
{
"type": "WEB",
"url": "https://github.com/theShinigami/CVE-Disclosures/blob/main/CVE-2025-71056/README.md"
},
{
"type": "WEB",
"url": "https://johnbai.en.made-in-china.com/product/JXnENzmlJFpv/China-H18gn-Series-Gpon-Ont-ONU.html"
},
{
"type": "WEB",
"url": "http://www.szgcom.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F9PC-9R24-4PR7
Vulnerability from github – Published: 2022-05-24 17:30 – Updated: 2022-05-24 17:30Improperly implemented security check in McAfee Active Response (MAR) prior to 2.4.4 may allow local administrators to execute malicious code via stopping a core Windows service leaving McAfee core trust component in an inconsistent state resulting in MAR failing open rather than closed
{
"affected": [],
"aliases": [
"CVE-2020-7326"
],
"database_specific": {
"cwe_ids": [
"CWE-290"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-15T10:15:00Z",
"severity": "MODERATE"
},
"details": "Improperly implemented security check in McAfee Active Response (MAR) prior to 2.4.4 may allow local administrators to execute malicious code via stopping a core Windows service leaving McAfee core trust component in an inconsistent state resulting in MAR failing open rather than closed",
"id": "GHSA-f9pc-9r24-4pr7",
"modified": "2022-05-24T17:30:47Z",
"published": "2022-05-24T17:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7326"
},
{
"type": "WEB",
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10331"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-F9WG-5F46-CJMW
Vulnerability from github – Published: 2022-04-22 20:49 – Updated: 2022-04-22 20:49next-auth v3 users before version 3.29.2 are impacted. (We recommend upgrading to v4 in most cases. See our migration guide).next-auth v4 users before version 4.3.2 are impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your callbacks option:
// async redirect(url, baseUrl) { // v3
async redirect({ url, baseUrl }) { // v4
// Allows relative callback URLs
if (url.startsWith("/")) return new URL(url, baseUrl).toString()
// Allows callback URLs on the same origin
else if (new URL(url).origin === baseUrl) return url
return baseUrl
}
If you already have a redirect callback, make sure that you match the incoming url origin against the baseUrl.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "next-auth"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.29.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "next-auth"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-24858"
],
"database_specific": {
"cwe_ids": [
"CWE-290",
"CWE-601"
],
"github_reviewed": true,
"github_reviewed_at": "2022-04-22T20:49:09Z",
"nvd_published_at": "2022-04-19T23:15:00Z",
"severity": "MODERATE"
},
"details": "`next-auth` v3 users before version 3.29.2 are impacted. (We recommend upgrading to v4 in most cases. See our [migration guide](https://next-auth.js.org/getting-started/upgrade-v4)).`next-auth` v4 users before version 4.3.2 are impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your `callbacks` option:\n\n```js\n// async redirect(url, baseUrl) { // v3\nasync redirect({ url, baseUrl }) { // v4\n // Allows relative callback URLs\n if (url.startsWith(\"/\")) return new URL(url, baseUrl).toString()\n // Allows callback URLs on the same origin\n else if (new URL(url).origin === baseUrl) return url\n return baseUrl\n}\n```\nIf you already have a `redirect` callback, make sure that you match the incoming `url` origin against the `baseUrl`.",
"id": "GHSA-f9wg-5f46-cjmw",
"modified": "2022-04-22T20:49:09Z",
"published": "2022-04-22T20:49:09Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-f9wg-5f46-cjmw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24858"
},
{
"type": "WEB",
"url": "https://github.com/nextauthjs/next-auth/commit/6e15bdcb2d93c1ad5ee3889f702607637e79db50"
},
{
"type": "PACKAGE",
"url": "https://github.com/nextauthjs/next-auth"
},
{
"type": "WEB",
"url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth%40v4.3.2"
},
{
"type": "WEB",
"url": "https://next-auth.js.org/configuration/callbacks#redirect-callback"
},
{
"type": "WEB",
"url": "https://next-auth.js.org/getting-started/upgrade-v4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "NextAuth.js default redirect callback vulnerable to open redirects"
}
GHSA-FC6G-2GCP-2QRQ
Vulnerability from github – Published: 2026-02-03 17:31 – Updated: 2026-02-03 18:55Summary
IP-based access control can be bypassed: get_condition_values trusts client-supplied X-Forwarded-For/X-Real-Ip without verifying a trusted proxy, so any reachable client can spoof aws:SourceIp and satisfy IP-allowlist policies.
Details
- Vulnerable code:
rustfs/src/auth.rs:289-304setsremote_addrfromX-Forwarded-For/X-Real-Ip, then insertsSourceIpviaget_source_ip_raw, with no trust boundary or proxy validation:let remote_addr = header.get("x-forwarded-for").and_then(...).or_else(|| header.get("x-real-ip")...).unwrap_or("127.0.0.1");args.insert("SourceIp", vec![get_source_ip_raw(header, remote_addr)]);
- This value feeds IAM/bucket policy evaluation in
rustfs/src/storage/access.rs(authorization path), so any request that forges the header can meetaws:SourceIpconditions. - No authentication is required beyond the request itself; the header is taken at face value even on direct connections.
PoC
rustfs-auth-trusted-ip-header-spoofing-poc.tar.gz
Steps (already included in rustfs-auth-trusted-ip-header-spoofing-poc/):
- Start RustFS with two local volumes, e.g.:
mkdir -p /tmp/rustfs-data1 /tmp/rustfs-data2
RUSTFS_ACCESS_KEY=devadmin RUSTFS_SECRET_KEY=devadmin \
cargo run --bin rustfs -- --address 0.0.0.0:9000 \
/tmp/rustfs-data1 /tmp/rustfs-data2
- From
rustfs-auth-trusted-ip-header-spoofing-poc/, run:
ENDPOINT=http://127.0.0.1:9000 make run
The script:
- Creates bucket `rustfs-trusted-ip-poc`.
- Applies a bucket policy allowing `s3:ListBucket` only from `10.0.0.5/32` (`Principal: {"AWS":["*"]},` Resource array).
- Sends three unauthenticated `ListBucket` calls:
- Baseline (no spoof) → HTTP 403.
- Spoofed `X-Forwarded-For: 10.0.0.5` → HTTP 200 (policy bypass).
- Spoofed `X-Forwarded-For: 1.2.3.4` → HTTP 403.
- Responses saved to `poc-baseline.xml`, `poc-spoofed.xml`, `poc-deny.xml`.
Impact
- Vulnerability type: Authorization bypass of IP-allowlist (
aws:SourceIp) via header spoofing. - Who is impacted: Any deployment relying on
aws:SourceIpin IAM/bucket policies for S3 operations. Attackers with network reach to RustFS can forge forwarded-IP headers to gain list/read/write where IP restrictions were meant to block them.
Credits
Identified by SecMate (https://secmate.dev) automated analysis and validated during manual triage.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "rustfs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.0-alpha.78"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-21862"
],
"database_specific": {
"cwe_ids": [
"CWE-290"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-03T17:31:41Z",
"nvd_published_at": "2026-02-03T16:16:12Z",
"severity": "HIGH"
},
"details": "### Summary\nIP-based access control can be bypassed: get_condition_values trusts client-supplied X-Forwarded-For/X-Real-Ip without verifying a trusted proxy, so any reachable client can spoof aws:SourceIp and satisfy IP-allowlist policies.\n\n### Details\n\n - Vulnerable code: `rustfs/src/auth.rs:289-304` sets `remote_addr` from `X-Forwarded-For`/`X-Real-Ip`, then inserts `SourceIp` via\n `get_source_ip_raw`, with no trust boundary or proxy validation:\n - `let remote_addr = header.get(\"x-forwarded-for\").and_then(...).or_else(|| header.get(\"x-real-ip\")...).unwrap_or(\"127.0.0.1\");`\n - `args.insert(\"SourceIp\", vec![get_source_ip_raw(header, remote_addr)]);`\n - This value feeds IAM/bucket policy evaluation in `rustfs/src/storage/access.rs` (authorization path), so any request that forges the header can meet `aws:SourceIp` conditions.\n - No authentication is required beyond the request itself; the header is taken at face value even on direct connections.\n\n\n### PoC\n\n[rustfs-auth-trusted-ip-header-spoofing-poc.tar.gz](https://github.com/user-attachments/files/24038162/rustfs-auth-trusted-ip-header-spoofing-poc.tar.gz)\n\n\nSteps (already included in `rustfs-auth-trusted-ip-header-spoofing-poc/`):\n\n 1. Start RustFS with two local volumes, e.g.:\n\n```\n mkdir -p /tmp/rustfs-data1 /tmp/rustfs-data2\n RUSTFS_ACCESS_KEY=devadmin RUSTFS_SECRET_KEY=devadmin \\\n cargo run --bin rustfs -- --address 0.0.0.0:9000 \\\n /tmp/rustfs-data1 /tmp/rustfs-data2\n```\n\n 2. From `rustfs-auth-trusted-ip-header-spoofing-poc`/, run:\n\n```\n ENDPOINT=http://127.0.0.1:9000 make run\n```\n\n The script:\n - Creates bucket `rustfs-trusted-ip-poc`.\n - Applies a bucket policy allowing `s3:ListBucket` only from `10.0.0.5/32` (`Principal: {\"AWS\":[\"*\"]},` Resource array).\n - Sends three unauthenticated `ListBucket` calls:\n - Baseline (no spoof) \u2192 HTTP 403.\n - Spoofed `X-Forwarded-For: 10.0.0.5` \u2192 HTTP 200 (policy bypass).\n - Spoofed `X-Forwarded-For: 1.2.3.4` \u2192 HTTP 403.\n - Responses saved to `poc-baseline.xml`, `poc-spoofed.xml`, `poc-deny.xml`.\n\n\n### Impact\n\n - Vulnerability type: Authorization bypass of IP-allowlist (`aws:SourceIp`) via header spoofing.\n - Who is impacted: Any deployment relying on `aws:SourceIp` in IAM/bucket policies for S3 operations. Attackers with network reach to RustFS can forge forwarded-IP headers to gain list/read/write where IP restrictions were meant to block them.\n\n### Credits\nIdentified by SecMate (https://secmate.dev) automated analysis and validated during manual triage.",
"id": "GHSA-fc6g-2gcp-2qrq",
"modified": "2026-02-03T18:55:45Z",
"published": "2026-02-03T17:31:41Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/rustfs/rustfs/security/advisories/GHSA-fc6g-2gcp-2qrq"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21862"
},
{
"type": "WEB",
"url": "https://github.com/rustfs/rustfs/commit/b4ba62fa3300b5b258fdc0da141481e3be7ea960"
},
{
"type": "PACKAGE",
"url": "https://github.com/rustfs/rustfs"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "RustFS has SourceIp bypass via spoofed X-Forwarded-For/Real-IP headers"
}
GHSA-FC9M-WJM7-WJ8R
Vulnerability from github – Published: 2025-01-21 18:31 – Updated: 2025-01-21 18:31In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration
{
"affected": [],
"aliases": [
"CVE-2025-24458"
],
"database_specific": {
"cwe_ids": [
"CWE-290"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-21T18:15:18Z",
"severity": "HIGH"
},
"details": "In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration",
"id": "GHSA-fc9m-wjm7-wj8r",
"modified": "2025-01-21T18:31:08Z",
"published": "2025-01-21T18:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24458"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-21: Exploitation of Trusted Identifiers
An adversary guesses, obtains, or "rides" a trusted identifier (e.g. session ID, resource ID, cookie, etc.) to perform authorized actions under the guise of an authenticated user or service.
CAPEC-22: Exploiting Trust in Client
An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
CAPEC-459: Creating a Rogue Certification Authority Certificate
An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.
CAPEC-461: Web Services API Signature Forgery Leveraging Hash Function Extension Weakness
An adversary utilizes a hash function extension/padding weakness, to modify the parameters passed to the web service requesting authentication by generating their own call in order to generate a legitimate signature hash (as described in the notes), without knowledge of the secret token sometimes provided by the web service.
CAPEC-473: Signature Spoof
An attacker generates a message or datablock that causes the recipient to believe that the message or datablock was generated and cryptographically signed by an authoritative or reputable source, misleading a victim or victim operating system into performing malicious actions.
CAPEC-476: Signature Spoofing by Misrepresentation
An attacker exploits a weakness in the parsing or display code of the recipient software to generate a data blob containing a supposedly valid signature, but the signer's identity is falsely represented, which can lead to the attacker manipulating the recipient software or its victim user to perform compromising actions.
CAPEC-59: Session Credential Falsification through Prediction
This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
CAPEC-60: Reusing Session IDs (aka Session Replay)
This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.
CAPEC-667: Bluetooth Impersonation AttackS (BIAS)
An adversary disguises the MAC address of their Bluetooth enabled device to one for which there exists an active and trusted connection and authenticates successfully. The adversary can then perform malicious actions on the target Bluetooth device depending on the target’s capabilities.
CAPEC-94: Adversary in the Middle (AiTM)
An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.