CWE-345.

Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)

• kubeflow pipelines
• Broken access control
• CWE-345

Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing

• pocket-id
• CWE-345

WatchGuard AuthPoint Gateway Improper HMAC Validation in LDAP Authentication Callback Allows Forged Authentication Results

• WatchGuard AuthPoint Authentication Gateway
• CWE-345

CoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing Zelty Webhook Signature Verification

• coopcycle-web
• CWE-345

Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verification

• Qihoo 360 D621-2
• Qihoo 360 D603-2
• Weak cryptography or TLS
• CWE-345

Emerson Ovation Insufficient Verification of Data Authenticity

• Emerson Ovation
• CWE-345

Dreeve before 5.8.0 Missing Authentication in Strava Webhook POST Handler

• robiningelbrecht dreeve
• CWE-345

Eupago Gateway For Woocommerce 4.5.0 - 4.7.5 - Unauthenticated Payment Confirmation Bypass

• Eupago Gateway For Woocommerce
• CWE-345

CryptoCloud - Crypto Payment Gateway 3.0.0 - 3.0.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Webhook Secret

• CryptoCloud
• CWE-345

Munshi Payment Bypass via Unauthenticated Webhook Endpoint

• Petpooja Munshi
• Authentication bypass
• CWE-345

PayHere Payment Gateway 2.4.0 - 2.4.5 - Unauthenticated Payment Bypass via Unverified Payment Notification

• PayHere Payment Gateway
• CWE-345

http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrity

• http4k
• CWE-345

ActivityPub Undo handler can unfollow or remove reposts on behalf of other accounts

• TryGhost ActivityPub
• Authentication bypass
• Broken access control

Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gate

• zuke
• CWE-345

Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector

• juspay hyperswitch
• CWE-345

Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• CWE-345

Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim

• Authentication bypass
• CWE-345

<6.2.0 · fixed in 6.2.0

filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

• CWE-345

>=3.22.0, <4.2.1 · fixed in 4.2.1

Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured

• Apache Software Foundation Apache Kafka
• Weak cryptography or TLS
• CWE-345

Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default

• Apache Software Foundation Apache Kafka
• CWE-345
• CWE-1188

Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privilege escalation

• Juniper Networks Session Smart Router
• Juniper Networks Session Smart Conductor
• CWE-345

Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature Bypass

• Sadad QA Payment
• CWE-345

BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Return Handler

• BitPay Gateway for WooCommerce
• CWE-345

mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks

• mewebstudio pos
• CWE-345

Fireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of Service

• WatchGuard Fireware OS
• Authentication bypass
• CWE-345

better-auth: OAuth Proxy lets an attacker sign in as another user

• Authentication bypass
• CWE-345

>=1.5.0-beta.12, <1.7.7 · fixed in 1.7.7

LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key

• Privilege escalation
• CWE-345

>=1.91.0, <1.100.4 || >=1.101.0, <1.101.3 || >=1.102.0, <1.102.2 || >=1.103.0, <1.103.1 || >=1.104.0rc1, <1.104.0rc2 · fixed in 1.100.4, 1.101.3, 1.102.2, 1.103.1, 1.104.0rc2

ML-KEM key-pair lookup can bind an unrelated or attacker-planted public key, exposing encapsulated shared secrets

• Eclipse Foundation Eclipse KeyPont
• CWE-345

PayDunya WooCommerce Payment Gateway 1.1.6 - Unauthenticated Order Payment Completion via Webhook Forgery

• PayDunya WooCommerce Payment Gateway
• CWE-345

DAMO Academy VideoLLaMA2 Model Loading __init__.py load_pretrained_model integrity check

• DAMO Academy VideoLLaMA2
• CWE-345
• CWE-354

rathena FluxCP PayPal IPN PaymentNotifyRequest.php verifyiprange origin validation

• rathena FluxCP
• CWE-345
• CWE-346

Eurobank WooCommerce Payment Gateway <= 2.1.1 - Unauthenticated Order Payment Forgery via Unverified Callback

• Eurobank WooCommerce Payment Gateway
• CWE-345

Yoosee GM8135S Camera Secure Boot signature verification

• Yoosee GM8135S Camera
• Weak cryptography or TLS
• CWE-345

Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget

• Qi Addons For Elementor
• CWE-345

Forged signed tokens let any registered user take over other users and organizations

• GitroomHQ postiz-app
• Authentication bypass
• Broken access control

Unauthenticated payment reuse allows unpaid orders to be marked as paid

• craftcms commerce-mollie
• CWE-345

chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

• CWE-345
• CWE-348

<5.4.0 · fixed in 5.4.0

vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine

• CWE-345

<0.31.0 · fixed in 0.31.0

SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin

• Information disclosure
• CWE-345

<0.0.0-20260808010544-26ccb40d390e · fixed in 0.0.0-20260808010544-26ccb40d390e

Goobi viewer: OpenID JWT audience not enforced by the verifier

• intranda goobi-viewer-core
• Authentication bypass
• CWE-345

Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title Tag

• Essential Addons for Elementor
• CWE-345

LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' Parameter

• LatePoint
• CWE-345

Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verification Bypass

• Simple Shopping Cart
• CWE-345

Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient

• Simple Shopping Cart
• CWE-345

Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret

• Payment Gateway for Telcell
• CWE-345

Duplicate Advisory: vLLM vulnerable to remote denial of service through forged multimodal UUID cache desynchronization

• CWE-345

* · no fixed version yet

Insufficient verification of data authenticity in Oracle Corporation Oracle Business Intelligence Enterprise Edition

• Oracle Corporation Oracle Business Intelligence Enterprise Edition
• CWE-345

Insufficient verification of data authenticity in Oracle Corporation Oracle Solaris

• Oracle Corporation Oracle Solaris
• CWE-345

Insufficient verification of data authenticity in Google Chrome

• Google Chrome
• CWE-345

Insufficient verification of data authenticity in Advantech ADAM-3600

• Advantech ADAM-3600
• CWE-345

LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verification

• LangBot
• CWE-345

BlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validation

• BlackBeltTechnology pi-agent-dashboard
• CWE-345
• CWE-346

Lack of integrity checks in Mobatek’s MobaXterm

• Mobatek MobaXterm
• CWE-345

iPOSpays Payment Gateway for WooCommerce < 1.4.7 - Unauthenticated Payment Confirmation Forgery

• iPOSpays Payment Gateway for WooCommerce
• CWE-345

Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber Webhook Signature Bypass

• Document Gallery
• CWE-345

Coinbase Commerce Payment Gateway for WooCommerce <= 1.4.1 - Unauthenticated Webhook Signature Bypass via Empty-Default Webhook Shared Secret

• Coinbase Commerce Payment Gateway for WooCommerce
• CWE-345

Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• CWE-345

ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

• CWE-345
• CWE-940

<0.4.112 · fixed in 0.4.112

SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generate

• sgl-project sglang
• CWE-345

Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

• Denial of service
• Broken access control

>=0.0.98, <1.6.0 · fixed in 1.6.0