CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
github.com/Kuadrant/mcp-gatewayGoMCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path9.3 Critical- mozilla firefox, thunderbird +1 moreSame-origin policy bypass in the Networking: JAR component6.5 Medium
- lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 moreImproper Origin Validation in mlflow/mlflow9.6 Critical
- mozilla firefox, thunderbird +1 moreSame-origin policy bypass in the Networking: HTTP component9.3 Critical
- mattermost, mattermost server +1 moreMissing request origin validation on burn-on-read reveal endpoint4.3 Medium
- kumahq kumaKuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin5.1 Medium
- kong inc. meshKong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin5.1 Medium
- sillytavernSillyTavern: Authentication Bypass via SSO Header Injection9.8 Critical
- cleanuparrCleanuparr: Reflective CORS combined with trusted-network auth allows cross-origin admin API reads8.0 High
- amir20 dozzleDozzle: Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpoints bypasses authentication8.7 High
@cyclonedx/cdxgennpm@cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry6.9 Medium- tubitak bilgem software technologies research institute liderahenkRCE in TUBITAK BILGEM's Liderahenk9.8 Critical
- google chromeInsufficient policy enforcement in Autofill in Google Chrome prior to 148.0.7778.96 allowed a...4.3 Medium
- google chromeInappropriate implementation in Media in Google Chrome prior to 148.0.7778.96 allowed a remote...4.3 Medium
- oracle macaron, oracle corporation macaron tool of oracle open source projects +1 moreVulnerability in the Oracle Macoron Tool product of Oracle Open Source Projects. The supported...4.7 Medium
- apache thriftApache Thrift: Node.js web_server.js multi-vulnerability7.3 High
- chatgptnextweb nextchatChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policy5.3 Medium
- alexta69 metubealexta69 MeTube CORS Policy main.py on_prepare cross-domain policy5.3 Medium
- berabuddies agentflowAgentFlow Local Web API Content-Type Validation Bypass4.8 Medium
- modelcontextprotocol rust-sdkRMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport8.8 High
- curlstale custom cookie host causes cookie leak7.5 High
- oppo wallet appSensitive Information Disclosure Vulnerability Caused by Trusted Domain Bypass in OPPO Wallet5.6 Medium
- openclawOpenClaw < 2026.4.2 - Sender Allowlist Bypass via Slack Thread Context2.3 Low
- zurich instruments labonePath Traversal Vulnerability in LabOne User Interface8.7 High
- locizelocize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor7.5 High
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 +19 more +21 moreundici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse7.5 High
- ericc-ch copilot-apiericc-ch copilot-api Token Endpoint server.ts cors cross-domain policy6.9 Medium
- pyload, pyload-ng project pyload-ng +1 morepyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)4.8 Medium
- wwbn avideoAVideo has CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) that Exposes Authenticated API Responses7.1 High
- farion1231 cc-switchfarion1231 cc-switch ProxyServer server.rs cross-domain policy5.3 Medium
- apollographql apollo mcp server, apollo-mcp-server +1 moreMissing Host Header Validation in Apollo MCP Server for Localhost Deployments6.8 Medium
- google chromeInappropriate implementation in Navigation in Google Chrome prior to 147.0.7727.55 allowed a...4.3 Medium
- google chromeInsufficient policy enforcement in History Navigation in Google Chrome prior to 147.0.7727.55...6.1 Medium
- zammadZammad has an origin validation error in SSO mechanism2.3 Low
- lfprojects mcp java sdk, modelcontextprotocol java-sdk +1 moreMCP Java-SDK has a DNS Rebinding Vulnerability7.6 High
- openclawOpenClaw - Unauthorized Agent Request Dispatch via Untrusted Local-Network Pages in iOS A2UI Bridge2.1 Low
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: org.keycloak.protocol.oidc.grants.ciba: keycloak: information disclosure via cors header injection due to unvalidated jwt azp claim3.7 Low
- directusDirectus is Missing Cross-Origin Opener Policy8.7 High
- openclawOpenClaw < 2026.3.31 - Arbitrary DNS Authority Acceptance and Credential Exfiltration via Wide-Area Discovery5.9 Medium
- openclawOpenClaw < 2026.3.31 - Cross-Site Request Forgery via Missing Browser-Origin Validation in HTTP Operator Endpoints2.3 Low
- electronElectron: Incorrect origin passed to permission request handler for iframe requests5.4 Medium
- openclawOpenClaw < 2026.3.31 - Matrix Thread Context Allowlist Bypass via Sender Validation2.3 Low
- signalk signal k server, signalk-server +1 moresignalk-server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow6.1 Medium
- vanna-ai vannavanna-ai vanna FastAPI/Flask Server cross-domain policy5.3 Medium
- google chromeInappropriate implementation in ANGLE in Google Chrome prior to 146.0.7680.178 allowed a remote...6.5 Medium
- openclawOpenClaw < 2026.3.28 - Unauthenticated Discovery Endpoint Credential Exfiltration via Remote Onboarding7.4 High
- parse-community parse-serverParse Server: GraphQL API endpoint ignores CORS origin restriction5.3 Medium
- hapifhir hl7 fhir core, org.hl7.fhir.core +1 moreHAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core7.4 High
- ultraviolet cocos ai, ultravioletrs cocos +1 moreCoCoS attested TLS is vulnerable to relay attacks via extracted ephemeral TLS keys7.5 High
@grackle-ai/servernpm@grackle-ai/server has Missing WebSocket Origin Header Validation7.1 High- Show moreLoading…