CWE-345: Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- python software foundation cpythonBase64 decoding stops at first padded quad by default6.0 Medium
- fluxcd notification-controllerFlux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering3.1 Low
- openclawOpenClaw < 2026.4.8 - Unsafe Request Body Replay via fetchWithSsrFGuard Cross-Origin Redirects7.1 High
- lobehubLobeHub has an unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header5.0 Medium
- wwbn avideoWWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php6.5 Medium
- rack rack-sessionRack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization9.3 Critical
- smub charitable – donation plugin for wordpress – fundraising with recurring donations & moreCharitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stri…5.3 Medium
- nimiq core-rs-albatross, proof-of-stake +1 morenimiq/core-rs-albatross: Macro block proposal interlink bug4.9 Medium
- nearform fast-jwtfast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)7.5 High
- openclawOpenClaw < 2026.4.2 - PKCE Verifier Exposure via OAuth State Parameter6.0 Medium
- nearform fast-jwtfast-jwt Affected by Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)9.1 Critical
- electronElectron: Service worker can spoof executeJavaScript IPC replies5.9 Medium
- No product listedAn issue in the firmware update mechanism of Qianniao QN-L23PA0904 v20250721.1640 allows...6.8 Medium
- jahlives openssl encryptopenssl_encrypt before 1.4.0 Schema Validation Bypass9.3 Critical
mppcrates.iompp has multiple payment bypass and griefing vulnerabilities9.3 Criticalmppxnpmmppx has multiple payment bypass and griefing vulnerabilities9.3 Critical- botpressBotpress - Credential Disclosure via Twilio Webhook Handler8.2 High
- openclawOpenClaw < 2026.3.22 - Unresolved Service Metadata Routing via Bonjour and DNS-SD Discovery5.1 Medium
- openfgaOpenFGA has an Authorization Bypass through cached keys5.8 Medium
- puttyPuTTY Ed25519 Signature ecc-ssh.c eddsa_verify signature verification6.3 Medium
- janmojzis tinysshjanmojzis tinyssh Ed25519 Signature crypto_sign_ed25519_tinyssh.c signature verification2.0 Low
- denx u-bootDas U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because...8.2 High
- bareboxbarebox: FIT Signature Verification Bypass Vulnerability8.3 High
- yi technology home cameraYi Technology YI Home Camera HTTP Firmware Update ipc signature verification9.2 Critical
- nhost, nhost storage +1 moreNhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage Upload2.1 Low
- hackerbay oneuptimeOneUptime: WhatsApp Webhook Missing Signature Verification8.7 High
- jetkvm, jetkvm kvm +1 moreJetKVM insufficient firmware verification7.0 High
- gl-inet comet kvm, comet gl-rm1 firmware +1 moreGL-iNet Comet (GL-RM1) KVM insufficient firmware verification7.0 High
- linuxfoundation onnx, red hat openshift ai (rhoai), openshift ai 2.25 +2 moreONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack8.6 High
- hcl aionHCL AION is affected by a vulnerability where model packaging and distribution mechanisms may not include sufficient authenticity verification.1.9 Low
- hcl aionMultiple security vulnerabilities affect HCL AION5.6 Medium
- jpadilla pyjwt, red hat openshift lightspeed, ai inference server +27 more +29 morePyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)7.5 High
zeptoclawcrates.ioZeptoClaw: Email Sender Spoofing to bypass Header-Only From Allowlist Validation6.5 Medium- qhkm zeptoclawZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload data8.2 High
- classroomioAn issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the...8.1 High
- microsoft windows app, windows app client for windows desktop +1 moreWindows App Installer Spoofing Vulnerability5.9 Medium
- hackerbay oneuptimeOneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding8.6 High
- mkj dropbearmkj Dropbear S Range Check curve25519.c unpackneg signature verification6.3 Medium
- caddyserver caddyCaddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation8.1 High
- olivetinOliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes8.8 High
- gogsGogs: Cross-repository LFS object overwrite via missing content hash verification9.3 Critical
- rustdesk, rustdesk-client rustdesk client +1 moreRustDesk Client Accepts Unauthenticated stop-service Command via Strategy Payload8.2 High
- rustdesk, rustdesk-client rustdesk client +1 moreRustDesk Client Blindly Merges Unauthenticated Strategy Payloads, Bypassing Local Security Settings8.3 High
- cloudflare pingora, https://github.com/cloudflare/pingora +1 moreCache poisoning via insecure-by-default cache key8.4 High
openclawnpmOpenClaw's voice-call Twilio replay dedupe now bound to authenticated webhook identity3.7 Low- openclawOpenClaw < 2026.2.21 - Client IP Spoofing via X-Forwarded-For Header Parsing6.3 Medium
- dataease sqlbotDataease SQLBot JWT Token auth.py validateEmbedded signature verification6.3 Medium
- cohesity tranzmanAn authenticated arbitrary file upload vulnerability in Cohesity TranZman Migration Appliance...7.2 High
- techjewel fluent forms pro add on packFluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Payment Status modification7.5 High
- unitree go2 firmware, unitreerobotics unitree go2 +1 moreUnitree Go2 Mobile Program Tampering Enables Root RCE6.4 Medium
- Show moreLoading…