CWE-1289.

In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently.

• Octopus Deploy Octopus Server
• CWE-1289

Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection

• edgelesssys contrast
• CWE-1289

webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint

• webpack-dev-server
• Information disclosure
• CWE-1289

Handlebars: JavaScript Injection via Own Property Check Bypass

• CWE-184
• CWE-1289

>=3.0.0, <4.7.10 · fixed in 4.7.10

Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers

• Server-side request forgery (SSRF)
• CWE-1289

>=1.56.0, <1.107.6 || >=2.0.0b1, <2.44.0 · fixed in 1.107.6, 2.44.0

Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes differently

• pydantic-ai
• pydantic-ai-slim
• Server-side request forgery (SSRF)
• CWE-1289

Octopus Deploy Octopus Server: In affected versions of Octopus Server…

• Octopus Deploy Octopus Server
• CWE-1289

Zilliz Attu: The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requests to…

• Zilliz Attu
• CWE-1289

JetBrains TeamCity: In JetBrains TeamCity before 2026.2, 2026.1.4…

• JetBrains TeamCity
• CWE-1289

WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability

• Liquid Web / StellarWP GiveWP
• CWE-1289

Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input

• Trusted Domain Project OpenDMARC
• CWE-20
• CWE-1289

Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS

• aws-network-policy-agent
• AWS amazon-vpc-cni-k8s
• CWE-1289

mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slot

• CWE-1289

>=0.2.0, <0.16.2 · fixed in 0.16.2

Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent

• AWS Amazon SSM Agent
• Server-side request forgery (SSRF)
• CWE-1289

Clickjacking vulnerability in SAPUI5(Frame Options Allowlist)

• SAP_SE SAPUI5(Frame Options Allowlist)
• CWE-1289

inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth

• Erlang OTP
• Broken access control
• CWE-1289

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep

• CWE-1289

Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check

• CWE-1289

Squid: Memory disclosure in FTP gateway

• squid
• Memory corruption
• CWE-1289

Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries

• CWE-1289

<1.21.0 · fixed in 1.21.0

Aqara OAuth redirect_uri validation bypass

• Aqara Cloud OAuth Authorization Endpoint
• CWE-1289

Hono: IP Restriction bypasses static deny rules for non-canonical IPv6

• CWE-185
• CWE-1289

<4.12.21 · fixed in 4.12.21

Net::CIDR::Set versions through 0.20 for Perl did not validate network masks

• RRWO Net::CIDR::Set
• CWE-1289

Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks

• RRWO Net::CIDR::Set
• CWE-1289

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

• HTTP request smuggling
• CWE-1289

<1.0.1 · fixed in 1.0.1

symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form

• CWE-1289

>=1.17.1, <1.38.1 · fixed in 1.38.1

Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring

• Weak cryptography or TLS
• CWE-180

<1.9.11 || >=1.10.0, <1.10.10 || >=2.0.0, <2.0.18 || >=2.1.0, <2.1.14 || >=2.2.0, <2.2.3 · fixed in 1.9.11, 1.10.10, 2.0.18, 2.1.14, 2.2.3

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

• CWE-1289

<0.55.0 · fixed in 0.55.0

Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass

• STIGTSP Net::CIDR::Lite
• CWE-1289

Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass

• STIGTSP Net::CIDR::Lite
• CWE-1289

webauthn-rs-core/webauthn-authenticator-rs: Origin validation mismatch possible when subdomains are allowed

• CWE-1289

<0.5.5 || >=0.6.0-dev, <0.6.1-dev · fixed in 0.5.5, 0.6.1-dev

DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode

• Cross-site scripting (XSS)
• CWE-1289

>=1.0.10, <3.4.0 · fixed in 3.4.0

@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes

• Authentication bypass
• CWE-1289

<5.3.0 · fixed in 5.3.0

Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header

• CWE-1287
• CWE-1289

>=5.3.2, <5.8.5 · fixed in 5.8.5

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

• Server-side request forgery (SSRF)
• CWE-441

<0.31.0 || >=1.0.0, <1.15.0 · fixed in 0.31.0, 1.15.0

mercure has Topic Selector Cache Key Collision

• CWE-1289

<0.22.0 · fixed in 0.22.0

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

• CWE-1289

>=1.26.0-0, <1.26.2 · fixed in 1.26.2

xdg-dbus-proxy has an eavesdrop filter bypass allowing message interception

• flatpak xdg-dbus-proxy
• CWE-1289

fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)

• CWE-345
• CWE-706

>=0.0.1, <6.2.0 · fixed in 6.2.0

Incorrect startup configuration in ZCC

• Zscaler Client Connector
• CWE-1289

OpenFGA has an Authorization Bypass through cached keys

• CWE-20
• CWE-345

<1.13.1 · fixed in 1.13.1

Squid has issues in ICP message handling

• squid
• Memory corruption
• CWE-1289

Ory Oathkeeper has an authentication bypass by cache key confusion

• CWE-305
• CWE-1289

<0.40.10-0.20260320084801-198a2bc82a99 · fixed in 0.40.10-0.20260320084801-198a2bc82a99

Devolutions PowerShell Universal: Improper input validation in the apps and endpoints configuration in PowerShell Universal…

• Devolutions PowerShell Universal
• CWE-1289

Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions

• CWE-1289

>=7.3.0-alpha.42, <9.0.0-alpha.8 · fixed in 9.0.0-alpha.8

Improper Validation of Unsafe Equivalence in Input in GitLab

• GitLab
• CWE-1289

`idna` accepts Punycode labels that do not produce any non-ASCII when decoded

• CWE-697
• CWE-1289

<1.0.0 · fixed in 1.0.0

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01.

• CWE-1289

AngularJS allows attackers to bypass common image source restrictions

• CWE-1289

>=1.3.0-rc.4, <=1.8.3 · no fixed version yet

MySQL & free URL mode allows to hide existing notes in hedgedoc

• hedgedoc
• CWE-1289

1Password 8 before 8.10.36 for macOS allows local attackers to exfiltrate vault items because XPC inter-process communication validation is insufficient.

• CWE-1289

1Password 8 before 8.10.38 for macOS allows local attackers to exfiltrate vault items by bypassing macOS-specific security mechanisms.

• CWE-1289

Puppet Firewall Module May Leave Unmanaged Rules

• Puppet Firewall Module
• CWE-1289