# CWE-1254.

Every Advisory and CVE whose sources give the weakness CWE-1254, newest first.

## Records, newest first

- [A logic issue was addressed with improved checks.](https://agentprime.io/advisories/CVE-2026-28929.md)
  `CVE-2026-28929` · CVE record: Apple iOS and iPadOS and 1 more · CVSS 7.5 High · Not analysed yet · Published 11 May 2026 · Tags: CWE-1254
- [CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)](https://agentprime.io/advisories/GHSA-8fq3-c5w3-pj3q.md)
  `GHSA-8fq3-c5w3-pj3q`, `CVE-2026-34572`, `PKSA-srvq-v3bs-mj79` · Packagist `ci4-cms-erp/ci4ms`: affected `<0.31.0.0`, fixed in `0.31.0.0` · CVSS 8.8 High · Not analysed yet · Published 1 Apr 2026 · Tags: Broken access control, Authentication bypass, CWE-1254
- [CI4MS: Account Deletion Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)](https://agentprime.io/advisories/GHSA-4vxv-4xq4-p84h.md)
  `GHSA-4vxv-4xq4-p84h`, `CVE-2026-34570`, `PKSA-xc2p-nr46-tjxw` · Packagist `ci4-cms-erp/ci4ms`: affected `<0.31.0.0`, fixed in `0.31.0.0` · CVSS 8.8 High · Not analysed yet · Published 1 Apr 2026 · Tags: Broken access control, Authentication bypass, CWE-1254
- [OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreation](https://agentprime.io/advisories/GHSA-xxvh-5hwj-42pp.md)
  `GHSA-xxvh-5hwj-42pp`, `CVE-2026-27007` · npm `openclaw`: affected `<2026.2.15`, fixed in `2026.2.15` · CVSS 4.8 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: CWE-1254
- [Plack::Middleware::Session versions before 0.17 for Perl may be vulnerable to HMAC comparison timing attacks](https://agentprime.io/advisories/CVE-2013-10031.md)
  `CVE-2013-10031` · CVE record: MIYAGAWA Plack::Middleware::Session · CVSS 7.5 High · Not analysed yet · Published 9 Dec 2025 · Tags: CWE-1254
- [GoCD API authentication of user access tokens subject to timing attack during comparison](https://agentprime.io/advisories/CVE-2022-39308.md)
  `CVE-2022-39308` · CVE record: gocd gocd · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2022 · Tags: CWE-208, CWE-1254
- [Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js](https://agentprime.io/advisories/GHSA-34r7-q49f-h37c.md)
  `GHSA-34r7-q49f-h37c`, `CVE-2015-8857` · npm `uglify-js` and 1 more: affected `<2.4.24`, fixed in `2.4.24` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-670, CWE-1254
- [Doorkeeper is vulnerable to replay attacks](https://agentprime.io/advisories/GHSA-3m6r-39p3-jq25.md)
  `GHSA-3m6r-39p3-jq25`, `CVE-2016-6582` · RubyGems `doorkeeper`: affected `<4.2.0`, fixed in `4.2.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-1254

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-1254>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-1254/>. Everything for agents: <https://agentprime.io/llms.txt>.