CWE-345: Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedImproper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME_1.00 allows...8.2 High
- parse-community parse-serverParse Server: Account takeover via JWT algorithm confusion in Google auth adapter9.3 Critical
- honoHono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo8.2 High
- automattic mongooseCesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verification6.3 Medium
- posimyththemes the plus addons for elementor – addons for elementor, page templates, widgets, mega menu, woocommerceThe Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Unauthenticated Email Relay5.3 Medium
- metagauss registrationmagic – custom registration forms, user registration, payment, and user loginRegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment5.3 Medium
openclawnpmOpenClaw inter-session prompts could be treated as direct user instructions7.1 High- openclawOpenClaw allows unauthenticated discovery TXT records to steer routing and TLS pinning7.1 High
- openclawOpenClaw < 2026.2.2 - Authorization Bypass via Unauthenticated Telegram Webhook8.2 High
- openclaw, openclaw voice-call +1 moreOpenClaw voice-call < 2026.2.3 - Webhook Verification Bypass via Forwarded Headers8.2 High
- openclawOpenClaw has a Telegram webhook request forgery (missing `channels.telegram.webhookSecret`) → auth bypass7.5 High
- cryptography.io cryptography, red hat openshift lightspeed, advanced cluster management for kubernetes 2 +23 more +25 morecryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves8.2 High
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 moreMicrosoft Exchange Server Spoofing Vulnerability6.5 Medium
- f5 nginx plus, nginx open source, nginx gateway fabric +2 more +4 moreNGINX vulnerability8.2 High
- openprojectOpenProject has Forced Actions, Content Spoofing, and Persistent DoS via ID Manipulation in OpenProject Blocknote Editor Extension6.3 Medium
- openprojectOpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server8.9 High
- juneandgreen sm-cryptosm-crypto Affected by Private Key Recovery in SM2-PKE9.1 Critical
- mineadminMineAdmin JWT Token refresh data authenticity2.3 Low
- linknacional rede itaú for woocommerce — payment pix, credit card and debitRede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.2 - Unauthenticated Order Status Manipulation5.3 Medium
- sigstore cosignCosign verification accepts any valid Rekor entry under certain conditions5.5 Medium
- tecno boomplay, tecno mobile com.afmobi.boomplayer +1 moreInsufficient Verification of Data Authenticity vulnerability in TECNO Mobile com.Afmobi...9.8 Critical
- pbootcmsPbootCMS Header handle.php get_user_ip less trusted source6.9 Medium
auth0/symfonyPackagistAuth0 Symfony SDK has Improper Audience Validation via Auth0-PHP SDK6.8 Medium- yhirose cpp-httplibcpp-httplib Untrusted HTTP Header Handling: Internal Header Shadowing (REMOTE*/LOCAL*)10.0 Critical
- entrust nshield 5c firmware, nshield connect xc base firmware, nshield connect xc high firmware +2 more +4 moreEntrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a...3.9 Low
- orangehrmOrangeHRM is Vulnerable to Account Takeover Through Unvalidated Username in Password Reset Workflow8.7 High
- better-authbetter-auth before 1.4.0 Session Revocation via Forged Cookie2.0 Low
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 moreUnauthenticated Arbitrary File Upload (upgrade_contents.php)9.9 Critical
- lfdt-lockness cggmp21CGGMP24 is missing a check in the ZK proof used in CGGMP219.3 Critical
- scott paterson subscriptions & memberships for paypalSubscriptions & Memberships for PayPal <= 1.1.7 - Unauthenticated Fake Payment Creation5.3 Medium
- egovframework/egovframe-common-componentseGovFramework <= 4.3.1 Unauthenticated Encryption Oracle via Web Editor Image Upload Endpoints8.7 High
- astrbotAstrBot is vulnerable to RCE with hard-coded JWT signing keys7.3 High
- mantisbtMantisBT: Authentication bypass for some passwords due to PHP type juggling5.4 Medium
- powerdns recursorCrafted delegations or IP fragments can poison cached delegations in Recursor6.5 Medium
- d-link dap-2695, dlink dap-2695 firmware +1 moreD-Link DAP-2695 Firmware Update sub_40C6B8 signature verification7.5 High
- google wearosIntent Abuse in Google Messages for Wear OS for Silent Message Sending6.9 Medium
- chatwootchatwoot Widget IFrameHelper.js initPostMessageCommunication origin validation6.9 Medium
- No product listedAn issue in the firmware update mechanism of Nous W3 Smart WiFi Camera v1.33.50.82 allows...6.8 Medium
- lukegus termixTermix' official Docker image contains an authentication bypass vulnerability9.2 Critical
- rapid7 appspider proRapid7 AppSpider Project Name Validation Bypass3.3 Low
- formbricksFormbricks missing JWT signature verification9.4 Critical
- suse rancherRancher CLI SAML authentication is vulnerable to phishing attacks8.0 High
- authlibAuthlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)7.5 High
- matrix-org matrix-js-sdkmatrix-js-sdk has insufficient validation when considering a room to be upgraded by another2.7 Low
- belkin ax1800Belkin AX1800 Firmware Update data authenticity8.6 High
- mmaitre314 picklescanpicklescan - Arbitrary Code Execution via torch.utils._config_module.load_config Bypass7.6 High
- mmaitre314 picklescanpicklescan - Remote Code Execution via torch.jit.unsupported_tensor_ops.execWrapper7.6 High
- mmaitre314 picklescanpicklescan - Undetected Remote Code Execution via torch.utils.collect_env.run7.6 High
- mmaitre314 picklescanpicklescan - Arbitrary Code Execution via torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression7.6 High
- mmaitre314 picklescanpicklescan - Remote Code Execution via torch._dynamo.guards.GuardBuilder.get7.6 High
- Show moreLoading…