CWE-602: Client-Side Enforcement of Server-Side Security
The product includes a server that relies on the client to implement a protection mechanism that is intended to protect the server.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- yealink meetingboard pro In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end... 8.2 High
- prosoft technology icx35-hwc-e, x35-hwc-a +1 more ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies 8.2 High
- eclipse foundation mnestix Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tampering 8.8 High
- admidio Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php 5.3 Medium
- sourcecodester online food ordering system SourceCodester Online Food Ordering System order.php client-side enforcement of server-side security 6.9 Medium
- mtrudel bandit WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit 6.3 Medium
- siemens ruggedcom crossbow A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices... 5.3 Medium
- siemens ruggedcom crossbow A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices... 5.3 Medium
- divasoft software and e-commerce inc. biletiva ticketing platform Improper Authorization in Divasoft Software's Biletiva Ticketing Platform 8.6 High
- tduckcloud tduck-survey-form TDuck survey form through 6.0 Write Password Bypass via Client-Side Enforcement 6.9 Medium
- mauriceboe trek TREK: Public trip share link ignores the `share_map` permission server-side (client-enforced authorization → itinerary/location disclosure) 5.3 Medium
- j2commerce.com j2store extension for joomla Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 8.7 High
- devolutions server Laci Synchroni Backend Vulnerable to Account Takeover / User Impersonation via Client-Side Configuration Manipulation 9.2 Critical
- kingdom communication associated eh1000b, eh2070, eh3040 +1 more +3 more Kingdom Communication Associated｜Smart Video Intercom System - Client-Side Authentication 6.9 Medium
- j2commerce.com j2store extension for joomla Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 8.7 High
- tsi-coop tsi-dpdp-cms tsi-coop tsi-dpdp-cms client-side enforcement of server-side security 6.9 Medium
- metagauss registrationmagic RegistrationMagic < 6.0.9.9 - Unauthenticated Payment Bypass via Omitted Price Field 5.3 Medium
- releasit cod form & upsells Releasit Releasit COD Form & Upsells OTP Validation client-side enforcement of server-side security 6.9 Medium
- jowilf starlette-admin Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS 5.4 Medium
- red hat multicluster engine for kubernetes 2.10, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.17 +3 more +5 more Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check 7.7 High
- tassos.gr convert forms extension for joomla Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 1.0.0-4.4.16, 5.0.0-5.2.5 6.9 Medium
- poxenstudio talebook MyBooks: Unauthenticated Registration Bypass via Missing Server-Side ALLOW_REGISTER Enforcement 6.9 Medium
- balbooa.com balbooa forms extension for joomla Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 7.7 High
- priority portal generator addon to priority erp (developed by soft solutions) Priority – CWE-602: Client-Side Enforcement of Server-Side Security 9.1 Critical
- ibm db2 IBM® Db2® is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data. 4.3 Medium
- progress whatsup gold WhatsUp Gold versions prior to 26.0.2 contain an improper authorization vulnerability in the Scheduled Reports API. 4.3 Medium
- dokploy Dokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts) 9.9 Critical
- unknown easy booking Easy Booking < 3.5.0 - Unauthenticated Minimum Booking Duration Bypass 5.3 Medium
- google chrome Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a... 6.5 Medium
- google chrome Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed a... 6.5 Medium
- google chrome Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72... 4.3 Medium
- google chrome Insufficient policy enforcement in WebView in Google Chrome on Android prior to 151.0.7922.72... 6.5 Medium
- google chrome Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an... 6.5 Medium
- google chrome Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72... 6.5 Medium
- google chrome Insufficient policy enforcement in Glic in Google Chrome on Android prior to 151.0.7922.72... 6.5 Medium
- google chrome Insufficient policy enforcement in Presentation in Google Chrome prior to 151.0.7922.72 allowed a... 6.5 Medium
- google chrome Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72... 6.5 Medium
- opensolution quick.cms Denial of Service in Quick.CMS 7.0 High
- jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a... 10.0 Critical
- jupyterlab JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass 6.0 Medium
- saturday drive ninja forms Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler 6.9 Medium
- gobito informatics technologies engineering industry and trade ltd. co. corporate training management system Business Logic Bypass in Gobito's Corporate Training Management System 4.3 Medium
- lissy93 dashy Dash: Users can write to config despire permissions (OIDC tested) 8.2 High
- google chrome Insufficient policy enforcement in Navigation in Google Chrome prior to 150.0.7871.115 allowed a... 4.3 Medium
- google chrome Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 allowed a remote... 9.6 Critical
- google chrome Insufficient policy enforcement in HID in Google Chrome prior to 150.0.7871.47 allowed a remote... 8.8 High
- google chrome Insufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871.47 allowed an... 6.5 Medium
- google chrome Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47... 4.3 Medium
- google chrome Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed a... 4.3 Medium
- google chrome Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an... 4.3 Medium
- Show olderLoading…