CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeInappropriate implementation in Autofill in Google Chrome on Android prior to 151.0.7922.72...4.3 Medium
- google chromeInappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote...3.1 Low
- google chromeInsufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a...3.1 Low
- google chromeInappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a...3.1 Low
- google chromeInappropriate implementation in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote...3.1 Low
- google chromeInsufficient policy enforcement in FileSystem in Google Chrome prior to 151.0.7922.72 allowed a...4.3 Medium
- google chromeInsufficient policy enforcement in Prefetch in Google Chrome prior to 151.0.7922.72 allowed a...4.3 Medium
- msi centerMSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation Vulnerability7.8 High
- modelcontextprotocol ruby-sdkMCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection6.9 Medium
- cordea oauthOAuth: Cross-origin token-request redirects can expose signed request metadata7.2 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Information Disclosure Vulnerability7.4 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability5.4 Medium
- @auth core, nextauthjs next-auth +1 moreNextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them6.8 Medium
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +2 moreOdh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validation8.8 High
- isc bind, bind 9 +1 moreDNSSEC Validation Bypass via Out-of-Zone NSEC Next Field8.6 High
- mozilla firefox, thunderbird +1 moreSite isolation issue in the DOM: Navigation component7.5 High
- mozilla firefox, thunderbird +1 moreSite isolation issue in the Graphics component7.5 High
- mozilla firefox, thunderbird +1 moreSite isolation issue in the Networking component9.8 Critical
- mozilla firefox, thunderbird +1 moreSame-origin policy bypass in the Networking: DNS component9.1 Critical
- mozilla firefox, thunderbird +1 moreSite isolation issue in the Graphics: WebRender component9.8 Critical
- mozilla firefox, thunderbird +1 moreSite isolation issue in the Networking: HTTP component9.8 Critical
- mozilla firefox, thunderbird +1 moreSame-origin policy bypass in the DOM: Navigation component9.8 Critical
- lharries whatsapp-mcp, verygoodplugins whatsapp mcp server +1 moreWhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltration7.7 High
- x-rite ma-t6Origin Validation Error in X-Rite MA-T69.8 Critical
- voxel51 fiftyoneFiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data6.3 Medium
- lfprojects mcp python sdk, modelcontextprotocol python-sdk +1 moreMCP Python SDK: WebSocket server transport does not support Host/Origin validation7.6 High
- lenovo browserLightpanda:URL parser misidentifies page origin for URLs containing @ in the path - Same-Origin Policy bypass9.3 Critical
- lenovo browserLightpanda: fetch() and XMLHttpRequest attach session cookies to cross-origin requests regardless of credentials mode9.3 Critical
- mervinpraison praisonaiPraisonAI before 4.6.78 Authentication Bypass via Host Header Spoofing8.8 High
- google chromeInappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote...6.5 Medium
- google chromeInsufficient policy enforcement in HTML-in-Canvas in Google Chrome prior to 150.0.7871.125...6.5 Medium
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +5 more +7 moreWindows Network Address Translation (NAT) Spoofing Vulnerability8.3 High
- eclipse vert.xIn Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across cross-origin HTTP 30x redirec…8.2 High
- eclipse vert.xIn versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession...8.2 High
- n8nn8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution7.6 High
- clineCline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)8.8 High
- guzzleGuzzle: Cookie Disclosure and Injection via IP-Address Domains4.7 Medium
- coollabsio coolifyCoolify: Password reset link poisoning via X-Forwarded-Host header spoofing5.3 Medium
- coderCoder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing5.8 Medium
- fossbillingFOSSBilling has an unauthenticated payment bypass via IPN callback forgery9.2 Critical
- daprDapr - OIDC Discovery Issuer and JWKS URI Injection via Unvalidated X-Forwarded-Host8.2 High
- google chromeInsufficient policy enforcement in Speech in Google Chrome prior to 150.0.7871.47 allowed a...4.3 Medium
- google chromeInsufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed a...4.3 Medium
- google chromeInappropriate implementation in FedCM in Google Chrome prior to 150.0.7871.47 allowed a remote...4.3 Medium
- google chromeInsufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed a...4.3 Medium
- google chromeInappropriate implementation in CustomTabs in Google Chrome on Android prior to 150.0.7871.47...4.3 Medium
- google chromeInsufficient policy enforcement in GetUserMedia in Google Chrome prior to 150.0.7871.47 allowed a...4.3 Medium
- google chromeInsufficient policy enforcement in Autofill in Google Chrome on iOS prior to 150.0.7871.47...6.5 Medium
- google chromeInappropriate implementation in NFC in Google Chrome on Android prior to 150.0.7871.47 allowed a...6.5 Medium
- google chromeInappropriate implementation in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a...6.5 Medium
- Show moreLoading…