CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- apple ipados, macos, safari +7 more +9 moreA logic issue was addressed with improved state management. This issue is fixed in Safari 26.4,...4.3 Medium
- hclsoftware travelerHCL Traveler is susceptible to a weak default HTTP header validation vulnerability6.3 Medium
- denx u-bootDas U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because...8.2 High
- bareboxbarebox: FIT Signature Verification Bypass Vulnerability8.3 High
- cryptomator android, cryptomator +1 moreCryptomator for Android: Tampered vault configuration allows MITM attack on Hub API7.6 High
- cisco ios, cryptomator +1 moreCryptomator for IOS: Tampered vault configuration allows MITM attack on Hub API7.6 High
- cryptomatorCryptomator: Tampered vault configuration allows MITM attack on Hub API7.6 High
- pyload, pyload-ng project pyload-ng +1 morepyload-ng: Improper Authentication and Origin Validation Error6.5 Medium
- jenkinsJenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation7.5 High
- apple ipados, macos, safari +3 more +5 moreA cross-origin issue in the Navigation API was addressed with improved input validation. This...5.4 Medium
- nicolargo glancesGlances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers8.1 High
- nicolargo glancesGlances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding5.9 Medium
- mattermost, mattermost server +1 moreWebSocket Message Spoofing via Permalink Embed Manipulation4.3 Medium
- openclawOpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy mode8.1 High
- unitycatalogUnity Catalog has a JWT Issuer Validation Bypass Allows Complete User Impersonation9.1 Critical
- mozilla firefoxSame-origin policy bypass in the CSS Parsing and Computation component6.5 Medium
- spomky-labs webauthn-lib, webauthn-symfony-bundle, webauthn framwork +1 more +3 moreWebauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation5.4 Medium
- apache apache-airflow-providers-amazon, apache software foundation airflow providers amazon +1 moreApache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass5.4 Medium
- darkreaderDark Reader gives users the ability to request style sheets from local web servers3.4 Low
- openclawOpenClaw < 2026.2.25 - Password Brute-Force via Browser-Origin WebSocket Authentication Bypass7.5 High
- f textreamTextream Cross-Site WebSocket Hijacking (CSWSH) vulnerability7.6 High
- calibre-ebook calibrecalibre has IP Ban Bypass via X-Forwarded-For Header Spoofing5.3 Medium
- clevertap web sdkCleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function8.3 High
- storybook, red hat enterprise linux 10, enterprise linux 9 +2 more +4 moreStorybook Dev Server Vulnerable to WebSocket Hijacking8.9 High
- genetec update serviceLocal admin could to leak information from the Genetec Update Service configuration web page. An...5.8 Medium
- mozilla firefox, thunderbird +1 moreSame-origin policy bypass in the Networking: JAR component9.8 Critical
- apache camelApache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy9.1 Critical
- karnop realtime-collaboration-platformCollabPlatform : CORS Misconfiguration Allows Arbitrary Origin With Credentials Leading to Authenticated Account Data Exposure7.4 High
- feathersjs feathersFeathers has an origin validation bypass via prefix matching7.6 High
- sveltejs kitCache poisoning in @sveltejs/adapter-vercel5.3 Medium
- openclawOpenClaw session tool visibility hardening and Telegram webhook secret fallback6.9 Medium
- proctorio secure exam proctor extensionInsufficient Origin Validation in Proctorio Chrome Extension postMessage Handlers3.6 Low
- gitlabOrigin Validation Error in GitLab8.0 High
- hp d9l18a firmware, d9l20a firmware, d9l21a firmware +46 more +48 moreCertain HP OfficeJet Pro Printers - Information Disclosure6.9 Medium
- avibia avibialine avlx1 hd 5.0, avibialine avlx2 hd 5.0, avibialine avlx4 hd 5.0 +27 more +29 moreMultiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated access to device configuration8.8 High
- aliasvaultAliasVault is Missing Origin Validation in Android Passkey Credential Provider6.1 Medium
- prowise reflectProwise Reflect v1.0.9 - Remote Keystroke Injection8.6 High
- appsmithAccount Takeover Vulnerability in Appsmith9.7 Critical
- lfprojects mlflow, mlflow mlflow/mlflow +1 moreDNS Rebinding Vulnerability in mlflow/mlflow8.1 High
- @tanstack react-router, shopify remix-run\/react +1 moreReact Router has CSRF issue in Action/Server Action Request Processing6.5 Medium
- trend micro, inc. micro apex central, trendmicro apex central +1 moreA message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote...7.5 High
- trend micro, inc. micro apex central, trendmicro apex central +1 moreA message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a...7.5 High
- trend micro, inc. micro apex central, trendmicro apex central +1 moreA LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote...9.8 Critical
- gonitro nitro pdf proAn issue was discovered in Nitro PDF Pro for Windows before 14.42.0.34. In certain cases, it...5.5 Medium
- fujitsu client computing limited security solution authconductor client basic v2Origin validation error issue exists in Fujitsu Security Solution AuthConductor Client Basic V2 2...8.5 High
- naver whale browser, navercorp whale +1 moreWhale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar...7.5 High
- johnson controls iq panels2, 2+, iqhub, iqpanel 4, powergJohnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation Error7.2 High
- langgenius difyA Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in...9.1 Critical
- langgenius difyA Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in...9.1 Critical
- mozilla firefox, thunderbird +1 moreSame-origin policy bypass in the Request Handling component6.5 Medium
- Show moreLoading…