CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- go-vikunja vikunja Vikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml Server 6.0 Medium
- kunchenguid lavish-axi Lavish: DNS rebinding allows any website to read arbitrary local files and inject prompts into the AI agent via the unauthenticated local server 8.1 High
- undici undici vulnerable to cross-user information disclosure via cross-origin redirect revalidation 5.9 Medium
- undici undici vulnerable to cache poisoning and cross-user disclosure via intermediate redirect hops 7.4 High
- mark3labs mcp-go mcp-go before v1.2.1 Origin Validation Error via Unvalidated Well-Known Protected Resource Metadata 5.1 Medium
- diillson chatcli ChatCLI before v1.215.2 Origin Validation Error via Unvalidated MCP OAuth Resource Indicator 5.1 Medium
- ultravioletrs cocos Cocos Intra-handshake attested TLS implementation is vulnerable to Diversion Attacks 9.1 Critical
- gpustack GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin 9.8 Critical
- omniauth OmniAuth: Host Header Injection Vulnerability 6.9 Medium
- sharpemu SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process execution 8.3 High
- tata motors ira 2.0, ira.ev +1 more Insecure Configuration Vulnerability in Tata Motors iRA and iRA.ev mobile application 7.1 High
- snowflake connector for .net, connector for python, go driver +7 more +9 more Missing origin validation for the externalbrowser authenticator callback in multiple Snowflake client drivers 6.5 Medium
- better-auth better auth @better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated... 9.1 Critical
- naver whale browser Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab... 7.5 High
- chainguard kaniko kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts 9.3 Critical
- No product listed Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state 8.8 High
- ladybird Ladybird: Missing origin-clean enforcement in CSSStyleSheet allows cross-origin CSS read and mutation 7.1 High
- wit synapps runtime WIT SynApps Runtime 1.4.11 Browser-Mediated SSRF via Controller Onboarding 5.3 Medium
- cakephp CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching 6.3 Medium
- google chrome Memory corruption in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker... 8.8 High
- gofiber fiber Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads 5.9 Medium
- ankimcp anki-mcp-server-addon AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools 8.8 High
- labstack echo Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers 5.9 Medium
- labstack echo Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default 5.3 Medium
- aws aws-api-mcp-server AWS API MCP Server OAuth Token Audience Validation Bypass 7.3 High
- watchguard fireware os Fireware OS Improper Authentication in AuthPoint MFA Verification Allows Session Hijacking 5.6 Medium
- mozilla firefox, thunderbird +1 more Site isolation issue in the DOM: Navigation component 8.1 High
- mozilla firefox, thunderbird +1 more Site isolation issue in the Networking: HTTP component 8.1 High
- mozilla firefox, thunderbird +1 more Same-origin policy bypass in the Address Bar component 8.1 High
- mozilla firefox, thunderbird +1 more Site isolation issue in the Networking: HTTP component 8.1 High
- mozilla firefox, thunderbird +1 more Same-origin policy bypass in the CSS Parsing and Computation component 8.1 High
- mozilla firefox, thunderbird +1 more Same-origin policy bypass in the CSS Parsing and Computation component 8.1 High
- mozilla firefox, thunderbird +1 more Same-origin policy bypass in the DOM: Navigation component 8.1 High
- flarum framework, nextcloud flow, vaadin +2 more Push Endpoint Returns Permissive CORS Headers 2.3 Low
- hitachi hirdb server version 10, hirdb server version 9, hirdb server version 9(32) +2 more +4 more Origin Validation Error Vulnerability in HiRDB 7.5 High
- rathena fluxcp rathena FluxCP PayPal IPN PaymentNotifyRequest.php verifyiprange origin validation 6.9 Medium
- rclone Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback 7.6 High
- twisted Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation 3.1 Low
- zephyrproject zephyr WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr 8.2 High
- videolan vlc for android VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider 2.1 Low
- webpack-dev-server webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades 8.2 High
- storybookjs storybook Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites 8.6 High
- electron Electron: openExternal permission requests can be attributed to the wrong origin 5.4 Medium
- electron Electron: HID and USB permission checks can be attributed to the wrong origin 5.4 Medium
- electron Electron: Pointer lock permission requests can be attributed to the wrong frame 5.4 Medium
- google chrome Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to... 8.8 High
- ccc-attestation attested-tls-poc CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay Attack 9.1 Critical
- blackbelttechnology pi-agent-dashboard BlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validation 5.3 Medium
- huangruiteng loopx LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files 7.1 High
- microsoft identity client for nodejs Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability 5.9 Medium
- Show olderLoading…