CWE-322.

Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts

• CWE-322

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no

• CWE-322

Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default

• Apache Software Foundation Apache Airflow SFTP provider
• CWE-322

Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default

• Apache Software Foundation Apache Airflow SSH provider
• Apache Software Foundation Apache Airflow SFTP provider
• CWE-322

FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol

• FFmpeg
• CWE-322

SSH Host Key Verification Bypass in HAVELSAN's Liman Render Engine

• HAVELSAN Inc. Liman Render Engine
• CWE-322

TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension

• Erlang OTP
• CWE-322

Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)

• CWE-322

<0.84.0 · fixed in 0.84.0

AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

• CWE-322

<1.45.28 · fixed in 1.45.28

Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key verification

• Apache Software Foundation Apache Airflow Git provider
• CWE-322

Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network att...

• CWE-322

<22.0.0 · fixed in 22.0.0

goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request

• Weak cryptography or TLS
• CWE-322

<2.0.7 · fixed in 2.0.7

Claude Desktop: SSH Host Key Verification Bypass Allows Man-in-the-Middle Attack on Remote Sessions

• anthropics claude-code
• Weak cryptography or TLS
• CWE-322

Zero Motorcycles Firmware Key Exchange without Entity Authentication

• Zero Motorcycles firmware
• CWE-322

Apstra: SSH host key validation vulnerability for managed devices

• Juniper Networks Apstra
• CWE-322

CoCoS attested TLS is vulnerable to relay attacks via extracted ephemeral TLS keys

• ultravioletrs cocos
• CWE-322
• CWE-346

Duplicate Advisory: Keylime Missing Authentication for Critical Function and Improper Authentication

• CWE-322

>=7.12.0, <7.12.2 || >=7.13.0, <7.13.1 · fixed in 7.12.2, 7.13.1

A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows...

• CWE-322

<7.12.0 · fixed in 7.12.0

SSH Hostkey Misconfiguration Vulnerability in Archer Devices

• TP-Link Systems Inc. Archer AX53 v1.0
• TP-Link Systems Inc. Archer BE3600 v1
• CWE-322

missing SFTP host verification with wolfSSH

• curl
• CWE-322

Sandboxie exposes encrypted sandbox key during password change

• Sandboxie
• Information disclosure
• Hard-coded credentials

Cisco Nexus Dashboard Fabric Controller SSH Host Key Vulnerability

• Cisco Data Center Network Manager
• Cisco Nexus Dashboard
• CWE-322

Backup uploads to ETM subject to man-in-the-middle interception

• Arista Networks Arista Edge Threat Management
• CWE-322

Brocade Fabric OS before 9.2.2 does not enforce strict host key checking

• Brocade Fabric OS
• CWE-322

Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem'

• Checkmk
• CWE-322

Foreman: host ssh key not being checked in remote execution

• Red Hat Satellite 6.15 for RHEL 8
• CWE-322

When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarder

• Authentication bypass
• CWE-322

<0.20 · fixed in 0.20

matrix-sdk-crypto contains potential impersonation via room key forward responses

• Authentication bypass
• CWE-322

<0.6.0 · fixed in 0.6.0

matrix-js-sdk subject to user impersonation due to key/device identifier confusion in SAS verification

• Authentication bypass
• CWE-322

<19.7.0 · fixed in 19.7.0

matrix-android-sdk2 vulnerable to Olm/Megolm protocol confusion

• Authentication bypass
• CWE-322

<1.5.1 · fixed in 1.5.1

matrix-android-sdk2 vulnerable to impersonation via forwarded Megolm sessions

• Authentication bypass
• CWE-322

<1.5.1 · fixed in 1.5.1

matrix-js-sdk subject to user spoofing via Olm/Megolm protocol confusion

• Authentication bypass
• CWE-322

<19.7.0 · fixed in 19.7.0

matrix-js-sdk subject to impersonated messages due to permissive key forwarding

• Authentication bypass
• CWE-322

<19.7.0 · fixed in 19.7.0

Matrix iOS SDK vulnerable to impersonation via forwarded Megolm sessions

• matrix-org matrix-ios-sdk
• Authentication bypass
• CWE-322

Matrix iOS SDK vulnerable ton Olm/Megolm protocol confusion

• matrix-org matrix-ios-sdk
• Authentication bypass
• CWE-322

Jenkins Git client plugin 3.11.0 does not perform SSH host key verification

• Weak cryptography or TLS
• CWE-322

<3.11.1 · fixed in 3.11.1

The Eclipse Foundation Eclipse Californium: In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3…

• The Eclipse Foundation Eclipse Californium
• CWE-322