CWE-345.

chi Has an IP Spoofing Vulnerability in `middleware.RealIP`

• Authentication bypass
• CWE-345

>=5.2.1, <5.3.0 · fixed in 5.3.0

chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution

• CWE-345
• CWE-346

>=0.9.0, <=1.5.5 · no fixed version yet

Gogs: LFS dedupe path leaks private repo content across tenants

• Broken access control
• CWE-345

<0.14.3 · fixed in 0.14.3

Paymenter doesn't reset email verification status after email change

• Authentication bypass
• CWE-345

<1.5.0 · fixed in 1.5.0

AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data

• CWE-345

<29.0 · fixed in 29.0

Cap-go - OTP Bypass via Response Manipulation in Email Verification

• Cap-go capgo
• CWE-345

http4k: `HmacSha256.hash` (despite the `Hmac` naming) computed a plain unkeyed digest; clarified by deprecation in favour of `Sha256.hash` / `Sha256.hmac`

• CWE-345

<6.49.0.0 · fixed in 6.49.0.0

Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag

• Race condition
• CWE-345

<=1.21.0-rc.0 · no fixed version yet

CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages

• Authentication bypass
• Weak cryptography or TLS

<1.8.1 || >=1.9.0, <1.9.1 · fixed in 1.8.1, 1.9.1

CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced

• Authentication bypass
• CWE-345

<1.8.1 || >=1.9.0, <1.9.1 · fixed in 1.8.1, 1.9.1

CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate

• Weak cryptography or TLS
• CWE-345

<1.8.1 || >=1.9.0, <1.9.1 · fixed in 1.8.1, 1.9.1

containerd: CRI checkpoint import allows local image tag poisoning

• CWE-345
• CWE-829

>=2.1.0, <2.1.9 || >=2.2.0, <2.2.5 || >=2.3.0, <2.3.2 · fixed in 2.1.9, 2.2.5, 2.3.2

symfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot binding

• CWE-345

>=2.8.0, <2.36.0 || >=3.0.0, <3.1.0 · fixed in 2.36.0, 3.1.0

Tilt: Cross-site WebSocket hijacking of the Tilt HUD stream

• CWE-345

>=0.24.0, <0.37.4 · fixed in 0.37.4

Apache APISIX: Openid-connect plugin Identity Header Spoofing

• Apache Software Foundation Apache APISIX
• CWE-345

PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks

• CWE-345

<3.4.10 || >=4.0.0, <4.0.7 || >=4.1.0, <4.1.7 · fixed in 3.4.10, 4.0.7, 4.1.7

OpenClaw: Bootstrap token replay could widen pending pairing scopes

• Privilege escalation
• CWE-345

<2026.5.12 · fixed in 2026.5.12

PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)

• Weak cryptography or TLS
• CWE-345

<4.6.59 · fixed in 4.6.59

PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals

• Broken access control
• CWE-345

>=4.5.2, <4.6.59 · fixed in 4.6.59

Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription

• gitroomhq postiz-app
• Broken access control
• CWE-345

Postiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgery

• gitroomhq postiz-app
• Broken access control
• CWE-302

hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`

• CWE-345

<4.12.25 · fixed in 4.12.25

Cookie injection was possible when opening a PDF link

• Mozilla Firefox for iOS
• Authentication bypass
• CWE-345

Cross-origin cookies could be leaked when opening a PDF link

• Mozilla Firefox for iOS
• CWE-345

@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning

• Weak cryptography or TLS
• CWE-345

<=19.2.25 || >=20.0.0-next.0, <20.3.25 || >=21.0.0-next.0, <21.2.17 || >=22.0.0-next.0, <22.0.1 · fixed in 20.3.25, 21.2.17, 22.0.1

Mastodon has a consent-check bypass in its remote Collections

• mastodon
• Broken access control
• CWE-345

Insufficient verification of data authenticity in Zoom Communications Remote Control for Zoom Contact Center

• Zoom Communications Remote Control for Zoom Contact Center
• CWE-345

OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning

• Information disclosure
• CWE-345

<1.16.0 · fixed in 1.16.0

Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload

• Authentication bypass
• CWE-345

<6.7.22 || >=7.0.0-rc.1, <7.0.0-rc12 · fixed in 6.7.22, 7.0.0-rc12

vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors

• CWE-345

<0.22.0 · fixed in 0.22.0

Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

• Authentication bypass
• CWE-345

>=5.5.0, <7.2.1 || >=8.0.0, <8.0.2 · fixed in 7.2.1, 8.0.2

Netty has Insufficient Bailiwick Validation for NS Records

• CWE-345
• CWE-346

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

• CWE-345
• CWE-346

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint

• smub WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
• CWE-345

Event Monster <= 2.1.0 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via em_capture_payment AJAX Action

• awordpresslife Event Monster – Event Manager, Ticket Booking & Registration
• CWE-345

WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint

• CWE-345

<=29.0 · no fixed version yet

Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending

• Broken access control
• CWE-345

>=1.6.0, <1.6.11 · fixed in 1.6.11

Shared Secret Quota Inflation

• Acer Connect M6E 5G Portable WiFi Router
• CWE-345

Incomplete message edit validation in matrix-sdk-ui

• CWE-345

>=0.0.0-0, <0.16.1 · fixed in 0.16.1

Dräger Infinity M540 VG4.1.1 Spoofed Network Message Handling DoS/Tampering

• Dräger Infinity Acute Care System
• Dräger Standalone Infinity M540 patient monitor
• CWE-345

authentik: SAML source does not validate Conditions, timing, or audience on assertions

• authentik
• CWE-345

stigmem-node's federation peer registration lacked explicit out-of-band approval

• Weak cryptography or TLS
• CWE-345

<0.9.0a2 · fixed in 0.9.0a2

stigmem-node's federation peer token timestamp validation may reject valid peer tokens

• CWE-345

<0.9.0a2 · fixed in 0.9.0a2

FreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID Path

• freescout
• Authentication bypass
• CWE-345

Contact Form 7 – PayPal & Stripe Add-on <= 2.4.9 - Unauthenticated Payment Bypass via Insufficient Verification of Data Authenticity via PayPal IPN Handler ('invoice'/'mc_gross' Verification)

• scottpaterson Contact Form 7 – PayPal & Stripe Add-on
• CWE-345

Microsoft UFO accepts cross-device TASK_END messages by session_id only, allowing peer task-result injection

• microsoft UFO
• Authentication bypass
• CWE-345

Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims

• CWE-345
• CWE-1287

>=6.3.0, <6.4.40 || >=7.4.0, <7.4.12 || >=8.0.0, <8.0.12 · fixed in 6.4.40, 7.4.12, 8.0.12

Samba: group policy certificate enrollment uses http:// without validation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-345

Kavita: Pre-Auth Account Takeover

• Kareadita Kavita
• Authentication bypass
• CWE-345

TypeBot: WhatsApp Webhook Endpoint Missing Signature Verification

• baptisteArno typebot.io
• Authentication bypass
• CWE-345

@hulumi/drift: Orphan reconciler accepted externally supplied execute plans

• CWE-345

<1.3.2 · fixed in 1.3.2

Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss

• CWE-345
• CWE-1240

<0.4.3 || >=0.5.0, <0.5.3 · fixed in 0.4.3, 0.5.3

nimiq-primitives: BlockInclusionProof interlink issue when hops are empty

• CWE-345

<=0.2.0 · no fixed version yet

RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM

• CWE-345
• CWE-426

<0.32.0 · fixed in 0.32.0

Insufficient verification of data authenticity in Mesalvo Meona Server and others

• Mesalvo Meona Server
• Mesalvo Meona Client
• CWE-345

AutoGPT Platform: Remote Code Execution via Unsafe Pickle Deserialization of Redis Cache Entries

• Significant-Gravitas AutoGPT
• Code injection
• Insecure deserialization

Mullvad VPN for macOS: Local Privilege Escalation via unverified bundle path in installer

• mullvadvpn-app
• Privilege escalation
• CWE-345

arnika is affected by medium-severity issues in UDP rotation, PQC handling, and KMS TLS

• Authentication bypass
• Weak cryptography or TLS

<1.0.1 · fixed in 1.0.1

Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE

• Authentication bypass
• Cross-site request forgery (CSRF)

<1.6.2 · fixed in 1.6.2

Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark

• Code injection
• Broken access control

<=3.8.8 · no fixed version yet