CWE-345: Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- simplesamlphpSimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`7.1 High
- zcashfoundation zebra, zebra-consensus +1 moreZEBRA: Sync restart poisoning from single unauthenticated peer via above-lookahead block5.3 Medium
- suse rancher, rancher fleet +1 moreSUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components8.3 High
- sigstore sigstore-jssigstore-js: Insufficient Verification of Data Authenticity6.5 Medium
- nodebbNodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User8.7 High
- myscale myscaledbMyScale MyScaleDB SegmentId.h getCacheKey data authenticity2.3 Low
- volcengine openvikingvolcengine OpenViking Local VectorDB Primary-key Label str_to_uint64.py str_to_uint64 data authenticity2.3 Low
- arc53 docsgptarc53 DocsGPT Credential Storage encryption.py encrypt_credentials data authenticity2.3 Low
- metagauss registrationmagic – custom registration forms, user registration, payment, and user loginRegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request5.3 Medium
- go-chi chigo-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header6.9 Medium
- go-chi chigo-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-For6.9 Medium
- pnpmpnpm: Unsafe default behavior breaks integrity check6.8 Medium
- pnpmpnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes8.8 High
- gogsGogs: LFS dedupe path leaks private repo content across tenants7.1 High
- paymenterPaymenter doesn't reset email verification status after email change4.3 Medium
- wwbn avideoAVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data6.5 Medium
- cap-go capgoCap-go - OTP Bypass via Response Manipulation in Email Verification9.3 Critical
org.http4k:http4k-coreMavenhttp4k: `HmacSha256.hash` (despite the `Hmac` naming) computed a plain unkeyed digest; clarified by deprecation in favour of `Sha256.hash` / `Sha256.hmac`8.2 Highgithub.com/crossplane/crossplaneGo,github.com/crossplane/crossplane/v2Go +1 moreCrossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag9.0 Critical- corewcfCoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages7.4 High
- corewcfCoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced7.4 High
- corewcfCoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate7.4 High
- containerdcontainerd: CRI checkpoint import allows local image tag poisoning5.6 Medium
- symfony uxSymfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding6.9 Medium
- tilt-dev tiltTilt: Cross-site WebSocket hijacking of the Tilt HUD stream8.3 High
- apache apisixApache APISIX: Openid-connect plugin Identity Header Spoofing5.3 Medium
web-token/jwt-bundlePackagist,web-token/jwt-experimentalPackagist,web-token/jwt-frameworkPackagist +1 more +3 morePHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks8.1 High- mervinpraison praisonaiPraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)8.6 High
- mervinpraison praisonaiPraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals8.8 High
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +6 more +8 more.NET Tampering Vulnerability7.0 High
- gitroomhq postiz-appPostiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription4.8 Medium
- gitroomhq postiz-appPostiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgery9.9 Critical
- openclawOpenClaw < 2026.5.12 - Bootstrap Token Replay via Pending Pairing Scope Widening2.3 Low
- honojs honoHono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`6.5 Medium
- mozilla firefox for ios, firefox mobile +1 moreCookie injection was possible when opening a PDF link4.3 Medium
- mozilla firefox for ios, firefox mobile +1 moreCross-origin cookies could be leaked when opening a PDF link6.5 Medium
- angularAngular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning8.8 High
- mastodonMastodon has a consent-check bypass in its remote Collections7.5 High
- openclawOpenClaw < 2026.5.7 - Hostname Prefix Matching Bypass in Trusted Retry Endpoint Validation6.0 Medium
- zoom remote control, zoom communications remote control for zoom contact center +1 moreInsufficient Verification of Data Authenticity in Remote Control for Zoom Contact Center for...7.8 High
- whiskeysockets baileys, @whiskeysockets/baileys +1 moreBaileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload9.3 Critical
- vllmvLLM: Artifact Pin Decay in vLLM allows pinned deployments to load unpinned code, weights, and processors6.5 Medium
- openfga, openfga helm charts +1 moreOpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoning5.0 Medium
- pumaPuma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections7.5 High
- smub wpforms – easy form builder for wordpress – contact forms, payment forms, surveys, & moreWPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint5.3 Medium
- awordpresslife event monster – event manager, ticket booking & registrationEvent Monster <= 2.1.0 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via em_capture_payment AJAX Action5.3 Medium
- better-auth better auth, better-auth +1 moreBetter Auth: Device authorization approve and deny accept any authenticated session while the user code is pending7.6 High
- acer connect m6e 5g portable wifi router, connect m6e 5g firmware +1 moreShared Secret Quota Inflation9.3 Critical
- matrix-org matrix-sdk-uimatrix-sdk-ui: Incomplete edit validation4.9 Medium
- dräger infinity acute care system, standalone infinity m540 patient monitor +1 moreDräger Infinity M540 VG4.1.1 Spoofed Network Message Handling DoS/Tampering8.8 High
- Show moreLoading…