CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- github.com/antono connect-corsOrigin validation error in the connect-xcors npm package5.3 Medium
- siyuan-note siyuanSiYuan before v3.8.4 Authentication Bypass via Missing Origin Header8.6 High
- siyuan-note siyuanSiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth7.2 High
- openclawOpenClaw before 2026.7.1 Approval Binding Logic Error7.5 High
- bytebase dbhubDBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution9.3 Critical
- discourseDiscourse: Wildcard iframe origin allowlist bypass via authority separators4.3 Medium
- yop poll, yourownprogrammer yop poll +1 moreYOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route8.8 High
- fabasoft folio clientFabasoft Folio Client before 2026, a locally installed component that communicates with the...6.5 Medium
- apache sling security, apache software foundation sling security bundle +1 moreApache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence7.3 High
- darkreaderDark Reader: Ability to request icon-like bitmap data from certain local web servers3.4 Low
- tencent browserskillTencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket Daemon6.9 Medium
- ultravioletrs cocosCocos AI: Intra-handshake attested TLS implementation is vulnerable to session-misbinding attacks for Intel TDX verifier path9.1 Critical
- ultravioletrs cocosCocos AI: Intra-handshake attested TLS implementation can accept Evidence with nil, empty, or omitted reportData in the AMD SEV-SNP path9.1 Critical
- f1bonacc1 process-composeProcess Compose: Browser DNS rebinding lets websites control local process-compose MCP tools5.1 Medium
- red hat build of apache camel 3.33.4.redhat, build of apache camel 4 for quarkus 3, build of apicurio registry 3 +19 more +21 moreResteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config7.4 High
- mattermost, mattermost desktop +1 moreMattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler3.8 Low
- mattermost, mattermost desktop +1 moreMattermost Desktop local network access from server-rendered content4.7 Medium
- isc bind 9NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets5.9 Medium
- ag-ui-protocol ag-uiag-ui-protocol ag-ui Event Application Layer agent.ts prepareRunAgentInput origin validation5.3 Medium
- ag-ui-protocol ag-uiag-ui-protocol ag-ui CORSMiddleware utils.py create_strands_app cross-domain policy2.3 Low
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated8.1 High
- mozilla firefox, thunderbird +1 moreSite isolation issue in the Reader Mode component5.4 Medium
- mozilla firefox, thunderbird +1 moreSite isolation issue in the Graphics component9.1 Critical
- arc53 docsgptDocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessage5.3 Medium
- apache software foundation storm webappApache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins8.1 High
- samsung exynos 1080 firmwareAn issue was discovered in NR RRC in Samsung Mobile Processor and Modem Exynos 1080, 2100, 1280,...4.0 Medium
- t-mart mouseholeMousehole: Unauthenticated HTTP/WebSocket boundary exposes and mutates MAM cookie state6.9 Medium
- designcomputer mysql mcp serverMySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)10.0 Critical
wpaDebian,wpa_supplicantAzure Linux +1 moreAn issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper...7.1 High- google chromeOrigin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote...4.3 Medium
- microsoft teams for android, teams +1 moreMicrosoft Teams for Android Information Disclosure Vulnerability5.8 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2012 +12 more +14 moreWindows DNS Spoofing Vulnerability8.1 High
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass9.1 Critical
- microsoft .net, .net 10.0 runtime, .net 11.0 runtime +7 more +9 more.NET Information Disclosure Vulnerability6.5 Medium
- wwbn avideoWWBN AVideo Cross-Site Request Forgery via get_domain() validation8.7 High
- mozilla firefox, thunderbird +1 moreSite isolation issue in the DOM: Navigation component9.8 Critical
- mozilla firefox, thunderbird +1 moreSpoofing issue in the DOM: Core & HTML component4.3 Medium
- mozilla firefox, thunderbird +1 moreSite isolation issue in the DOM: Push Subscriptions component9.8 Critical
- mozilla firefox, thunderbird +1 moreSite isolation issue in the DOM: Navigation component9.8 Critical
- toggl oü track extensionToggl OÜ Toggl Track Extension postMessage origin validation5.3 Medium
- ash-project ash aiMCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header7.4 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Security Feature Bypass Vulnerability5.4 Medium
- spring cloud function, vmware spring cloud function +1 moreSpring Cloud Function can incorrectly determine if URI is secure3.1 Low
- dropbox mcp-server-dashDropbox Dash MCP Server DNS Rebinding via Missing Host Header Validation2.3 Low
- timescale tiger-gh-mcp-serverTimescale tiger-gh-mcp-server DNS Rebinding via Disabled Host Header Allow-List7.6 High
- timescale tiger-slackTimescale tiger-slack DNS Rebinding via Disabled Host Header Allow-List7.6 High
- timescale pg-aiguideTimescale pg-aiguide through 0.5.0 DNS Rebinding via Disabled Host Header Allow-List7.6 High
- mark3labs mcp-gomcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding7.6 High
- geiserx genieacs-mcpgenieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport8.8 High
- mervinpraison praisonaiPraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server7.6 High
- Show moreLoading…