Advisories · Weakness
CWE-1254.
Every Advisory and CVE whose sources give the weakness CWE-1254, newest first.
- CVSS 7.5 High
A logic issue was addressed with improved checks.
- Apple iOS and iPadOS
- Apple macOS
- CWE-1254
- CVSS 8.8 High
CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)
- Broken access control
- Authentication bypass
<0.31.0.0 · fixed in 0.31.0.0
GHSA-8fq3-c5w3-pj3q · CVE-2026-34572 - CVSS 8.8 High
CI4MS: Account Deletion Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)
- Broken access control
- Authentication bypass
<0.31.0.0 · fixed in 0.31.0.0
GHSA-4vxv-4xq4-p84h · CVE-2026-34570 - CVSS 4.8 Medium
OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreation
- CWE-1254
<2026.2.15 · fixed in 2026.2.15
GHSA-xxvh-5hwj-42pp · CVE-2026-27007 - CVSS 7.5 High
Plack::Middleware::Session versions before 0.17 for Perl may be vulnerable to HMAC comparison timing attacks
- MIYAGAWA Plack::Middleware::Session
- CWE-1254
- CVSS 6.5 Medium
GoCD API authentication of user access tokens subject to timing attack during comparison
- gocd
- CWE-208
- CWE-1254
- CVSS 9.8 CriticalCritical · CVSS 9+
Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js
- CWE-670
- CWE-1254
<2.4.24 · fixed in 2.4.24
GHSA-34r7-q49f-h37c · CVE-2015-8857 - CVSS 9.1 CriticalCritical · CVSS 9+
Doorkeeper is vulnerable to replay attacks
- CWE-1254
<4.2.0 · fixed in 4.2.0
GHSA-3m6r-39p3-jq25 · CVE-2016-6582