CWE-345: Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- goauthentik authentikauthentik: SAML source does not validate Conditions, timing, or audience on assertions6.9 Medium
- eidetic-labs stigmemstigmem Federation Peer Registration Authentication Bypass9.1 Critical
- eidetic-labs stigmemstigmem Federation Peer Token Timestamp Validation Bypass7.1 High
- freescout-help-desk freescoutFreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID Path7.5 High
- wwbn avideoWWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint7.1 High
- scott paterson contact form 7 – paypal & stripe add-onContact Form 7 – PayPal & Stripe Add-on <= 2.4.9 - Unauthenticated Payment Bypass via Insufficient Verification of Data Authenticity via PayPal IPN Handler ('invoice'/'mc_gross' Verification)5.3 Medium
- microsoft ufoMicrosoft UFO accepts cross-device TASK_END messages by session_id only, allowing peer task-result injection5.9 Medium
- sensiolabs symfony, symfony security-http +1 moreSymfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims8.8 High
- kareadita kavitaKavita: Pre-Auth Account Takeover9.3 Critical
- samba, red hat enterprise linux 10, enterprise linux 10.0 extended update support +22 more +24 moreSamba: group policy certificate enrollment uses http:// without validation8.0 High
- baptistearno typebot.ioTypeBot: WhatsApp Webhook Endpoint Missing Signature Verification6.5 Medium
- hulumi drift@hulumi/drift before 1.3.2 Unsafe Execute Plan Acceptance9.3 Critical
- plonky3Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss8.9 High
- nimiq core-rs-albatrossnimiq-primitives: BlockInclusionProof interlink issue when hops are empty5.9 Medium
- rtk-ai rtkRTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM6.9 Medium
- mesalvo meona client, meona server +1 moreInsufficient Verification of Data Authenticity vulnerability in Mesalvo Meona Client Launcher...2.3 Low
- significant-gravitas autogptAutoGPT Platform: Remote Code Execution via Unsafe Pickle Deserialization of Redis Cache Entries7.6 High
- mullvad vpn, mullvadvpn-app +1 moreMullvad VPN for macOS: Local Privilege Escalation via unverified bundle path in installer7.3 High
github.com/arnika-project/arnikaGoarnika is affected by medium-severity issues in UDP rotation, PQC handling, and KMS TLS6.3 Medium- better-authbetter-auth before 1.6.2 OAuth State Validation Bypass6.0 Medium
- electermelecterm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmark9.4 Critical
- wavelens gradientGradient: Unauthenticated worker on /proto → arbitrary NAR write / cache poisoning9.4 Critical
- cubecart v6CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header8.1 High
- go-gitgo-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git7.0 High
- enchant97 note-markNote Mark: JWT Secret Weakness allows Full Account Takeover via token forgery10.0 Critical
- awspring spring-cloud-aws, io.awspring.cloud spring-cloud-aws-sns +1 moreSpring Cloud AWS: Missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications6.3 Medium
com.getaxonflow:axonflow-sdkMavenaxonflow-sdk-java: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification5.9 Medium@axonflow/sdknpmaxonflow-sdk-typescript: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification5.9 Mediumgithub.com/getaxonflow/axonflow-sdk-goGo,github.com/getaxonflow/axonflow-sdk-go/v2Go,github.com/getaxonflow/axonflow-sdk-go/v3Go +2 more +4 moreaxonflow-sdk-go: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification5.9 MediumaxonflowPyPIaxonflow-sdk-python: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification5.9 Medium- dani-garcia vaultwardenVaultwarden WebAuthn credential metadata tampered before signature verification5.3 Medium
- nuts-foundation nuts-nodenuts-node: JWT type confusion in v1 access token introspection allows VP replay as access token4.4 Medium
- chainguard-dev apkoapko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)7.5 High
- dolibarr erp crmDolibarr ERP CRM Online Signature security.lib.php dol_verifyHash signature verification6.3 Medium
- trendnet tew-821dap, tew-821dap firmware +1 moreTRENDnet TEW-821DAP Firmware Update cameo_dev.sh platform_do_upgrade_cameo_dev data authenticity6.3 Medium
- trendnet tew-821dap, tew-821dap firmware +1 moreTRENDnet TEW-821DAP Firmware Update new_gui_update_firmware data authenticity6.3 Medium
- rustaurius five star restaurant reservations – wordpress booking pluginFive Star Restaurant Reservations <= 2.7.16 - Unauthenticated Payment Bypass via PHP Type Juggling in 'payment_id' Parameter5.3 Medium
- roadiz core-bundle-dev-appRoadiz OpenID Connect nonce generated but never validated — ID token replay attack5.7 Medium
- hickory project dnsHickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data...4.0 Medium
- openclawOpenClaw < 2026.4.20 - Improper Trust Labeling in Isolated Cron Awareness Events6.3 Medium
- automattic mongooseCesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification6.3 Medium
- amazon tough, tuftool +1 moreMissing Delegated Metadata Validation in awslabs/tough7.1 High
- traefik, red hat openshift dev spaces 3.28 +1 moreTraefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth7.8 High
- newapi new api, quantumnous new-api +1 moreNew API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud7.1 High
- nimiq nimiq-block, proof-of-stake +1 morenimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation9.6 Critical
- gitroom postiz, gitroomhq postiz-app +1 morePostiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS8.9 High
- openclawOpenClaw < 2026.4.10 - Unsanitized External Input in Agent Hook Events9.3 Critical
@paperclipai/servernpmPaperclip: Approval decision attribution spoofing via client-controlled `decidedByUserId` in paperclip server4.3 MediumNuGet.CommandLineNuGet,NuGet.PackagingNuGet,NuGet.ProtocolNuGet +2 moreDefense in Depth update for NuGet ClientNo score- succinct sp1SP1 V6 Recursion Circuit Row-Count Binding Gap8.9 High
- Show moreLoading…