CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- erudika scooldScoold: CORS wildcard origin with credentials enabled allows cross-origin authenticated API access from any domain5.4 Medium
- nodejs undiciundici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects7.4 High
- aliasvaultAliasVault: Browser extension WebAuthn bridge accepts forged origin/RP ID8.1 High
- angular, angular devtools +1 moreAngular DevTools (Local DoS)5.1 Medium
- legacyupdateLegacy Update ActiveX control accepts unauthorized hosting origins9.9 Critical
- microsoft .net 10.0 runtime, .net 11.0 runtime, .net 8.0 runtime +3 more +5 more.NET Information Disclosure Vulnerability5.3 Medium
- microsoft azure-keyvault-administration, azure-keyvault-certificates, azure-keyvault-keys +1 more +3 moreAzure Key Vault Information Disclosure Vulnerability5.9 Medium
- microsoft power apps for androidMicrosoft Power Apps Remote Code Execution Vulnerability8.0 High
- microsoft azure cli, azure devops cli extension +1 moreAzure DevOps Information Disclosure Vulnerability6.5 Medium
- mozilla firefox, thunderbird +1 moreSame-origin policy bypass in the DevTools component9.1 Critical
- mozilla firefox for iosSaved credentials can be autofilled after cross-origin navigation5.5 Medium
- microsoft .net 10.0 runtime, .net 11.0 runtime, .net 8.0 runtime +3 more +5 more.NET Security Feature Bypass Vulnerability6.5 Medium
- mozilla firefox, thunderbird +1 moreSite isolation issue in the Networking component8.1 High
- privasys ra-tls-clientsPrivasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack)9.1 Critical
- the-40-thieves obsidian-tcobsidian-tc Streamable HTTP transport permits cross-origin loopback vault access8.8 High
- jovancoding network-aiNetwork-AI before 5.15.2 CORS Origin Validation Error in MCP SSE Transport2.3 Low
- open-webuiOpen WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal8.6 High
- progress software corporation marklogic serverInsufficient isolation of user-supplied code in Progress MarkLogic Server9.6 Critical
- privasys ra-tls-clientsra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session9.1 Critical
- privasys enclave-os-virtualenclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session9.1 Critical
- ecies goPrivasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session9.1 Critical
- privasys rustlsPrivasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session9.1 Critical
- privasys enclave-os-minienclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session9.1 Critical
- @tinacms app, tinacms +1 moreTinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment9.3 Critical
- 0xjacky nginx-uiNginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout5.3 Medium
- pydantic pydantic-ai, pydantic-ai-slim, ai +2 more`pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that can trigger agent tool execution7.6 High
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 morePydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header6.4 Medium
- progressive robot ltd hmailserverOrigin Validation Error in hMailServer7.5 High
- eclipse ditto ditto explorer uiUnvalidated environments URL allows OAuth authorization code + PKCE verifier theft and account...7.1 High
- asynchttpclient async-http-clientAsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities7.6 High
- asynchttpclient async-http-clientAsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins7.4 High
- ovhcloudAuthenticated SMTP Sender Address Forgery6.3 Medium
- giteaGitea migration SSRF through ALLOWED_DOMAINS address check bypass7.7 High
- payloadcms payloadPayload external upload trust validation issue7.2 High
- laurent22 joplinJoplin Web Clipper pairing allows cross-origin theft of a permanent API token8.0 High
- heymrun heymHeym before v0.0.112 HITL Review Token Leak via Spoofable Origin Header5.3 Medium
- vercel next.jsNext.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass6.3 Medium
- vercel next.jsNext.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint2.3 Low
- authlibCVE-2026-1040569.8 Critical
- @capacitor android, ios, ionic-team capacitor +2 more +4 moreCapacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path9.3 Critical
- moodleMoodle: csrf in xml grade import6.5 Medium
- hangwin mcp-chrome-bridgemcp-chrome-bridge through 1.0.31 CORS Origin Bypass8.6 High
- electronElectron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled7.4 High
- electronElectron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab8.2 High
- trusted domain project opendmarcTrusted Domain Project OpenDMARC PSL Wildcard opendmarc_tld.c : opendmarc_get_tld origin validation5.3 Medium
- mozilla firefox, thunderbird +1 moreMitigation bypass in the DOM: Navigation component8.1 High
- mozilla firefox, thunderbird +1 moreSite isolation issue in the Panning and Zooming component4.7 Medium
- mozilla firefox, thunderbird +1 moreSite isolation issue in the DOM: Networking component8.1 High
- mozilla firefox, thunderbird +1 moreSame-origin policy bypass in the DevTools component8.1 High
- mozilla firefox, thunderbird +1 moreSame-origin policy bypass in the WebExtensions component8.1 High
- Show moreLoading…