CWE-345.

Apache CXF: Self-issued ID token claims validation skipped

• Apache Software Foundation Apache CXF
• CWE-345

Openshift/oauth-proxy: openshift/oauth-proxy: unauthenticated identity header injection on whitelisted paths

• Red Hat OpenShift Container Platform 4
• CWE-345

marimo < 0.23.15 API Key Exfiltration via Malicious Notebook PEP-723 Metadata

• marimo
• CWE-345

Production Debug-Unlock Token Verification Missing Device Binding

• Caliptra Core ROM
• Caliptra Core Firmware
• CWE-345

Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

• CWE-345

<=19.2.25 || >=20.0.0-next.0, <20.3.27 || >=21.0.0-next.0, <21.2.19 || >=22.0.0-next.0, <22.0.2 · fixed in 20.3.27, 21.2.19, 22.0.2

@fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header

• @fastify/aws-lambda
• CWE-345

S/MIME validator trusts signer-asserted signingTime for path validation

• Legion of the Bouncy Castle Inc. BC-JAVA
• Legion of the Bouncy Castle Inc. BC-LTS-JAVA
• CWE-345

Wazuh before 5.0.0-beta3 Cluster Attribution Spoofing via Inventory Sync

• wazuh
• CWE-345

Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via Block Attributes

• Spectra Legacy
• CWE-345

WordPress MasterStudy LMS plugin <= 3.7.39 - Broken Access Control vulnerability

• StylemixThemes MasterStudy LMS
• CWE-345

Stackrox: stackrox: deploy-time policy enforcement and visibility bypass via label injection

• Red Hat Advanced Cluster Security 4
• CWE-345

joserfc accepts JWT with padding, leading to JWT malleability

• authlib joserfc
• CWE-345

Insufficient verification of Hex package metadata in Gleam

• gleam
• CWE-345

Eda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dn

• Red Hat Ansible Automation Platform 2.5 for RHEL 8
• Red Hat Ansible Automation Platform 2.5 for RHEL 9
• CWE-345

OmniFaces: Forged combined-resource IDs and related output/push boundaries

• Cross-site scripting (XSS)
• Information disclosure

<1.14.3 || >=2.0.0, <2.7.33 || >=3.0.0, <3.14.23 || >=4.0.0, <4.7.12 || >=5.0.0, <5.4.2 · fixed in 1.14.3, 2.7.33, 3.14.23, 4.7.12, 5.4.2

Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)

• Broken access control
• Cross-site request forgery (CSRF)

<=3.38.1 · no fixed version yet

Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in

• Authentication bypass
• CWE-345

>=1.1.3, <1.6.22 || >=1.7.0-beta.0, <1.7.0-beta.10 · fixed in 1.6.22, 1.7.0-beta.10

LOIDC nonce validation bypass

• Logto
• CWE-345

SAML <Conditions> element not validated

• Logto
• CWE-345

Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

• CWE-345
• CWE-346

<0.41.3 · fixed in 0.41.3

RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation

• PowerDNS Recursor
• Weak cryptography or TLS
• CWE-345

Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incorrectly.

• CWE-345

n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login

• Broken access control
• CWE-345

<2.31.5 || >=2.32.0, <2.32.1 · fixed in 2.31.5, 2.32.1

DialogHandler Parameters Tampering Vulnerability in Telerik UI for ASP.NET AJAX

• Progress Software Telerik UI for ASP.NET AJAX
• CWE-345

BOGUS configured primary hostname accepted for XFR in auth/rpz zones

• NLnet Labs Unbound
• CWE-345

Cross-zone wildcard cache poisoning via RRSIG.labels manipulation

• NLnet Labs Unbound
• CWE-345

Open redirect in Oracle Corporation Oracle Production Scheduling

• Oracle Corporation Oracle Production Scheduling
• Open redirect
• CWE-345

Microsoft Security Advisory CVE-2026-50526 – .NET Tampering Vulnerability

• Path traversal
• CWE-345

>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.29, 9.0.18, 10.0.10

Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability

• Weak cryptography or TLS
• CWE-345

>=8.0.0, <8.0.4 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.4, 9.0.18, 10.0.10

Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content

• CWE-345
• CWE-1284

<3.3.0 · fixed in 3.3.0

Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password

• Kirki
• CWE-345

Reviews Feed < 2.6.5 - Unauthenticated Stored Arbitrary Shortcode Execution via Google Reviews

• Reviews Feed
• CWE-345

SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft

• signoz
• Open redirect
• CWE-345

OpenClaw < 2026.6.5 Authentication Bypass via HTTP Canvas

• OpenClaw
• CWE-345

Quicly is vulnerable to stateless reset injection

• h2o quicly
• CWE-345
• CWE-665

Activepieces: Cross-tenant file download via missing JWT audience check on step-files signed URL

• activepieces
• Broken access control
• CWE-345

Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook

• gitroomhq postiz-app
• Broken access control
• CWE-345

Insufficient verification of data authenticity in Eclipse Foundation Eclipse Kura

• Eclipse Foundation Eclipse Kura
• CWE-345
• CWE-348

WP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler

• thimpress WP Hotel Booking
• CWE-345

melange: Incomplete package integrity verification allows data section substitution

• CWE-345
• CWE-354

<1.2.9 · fixed in 1.2.9

sigstore-go has a multi-log threshold bypass via single compromised log

• Weak cryptography or TLS
• CWE-345

<1.2.0 · fixed in 1.2.0

Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding)

• discourse
• CWE-345

@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints

• Server-side request forgery (SSRF)
• CWE-20

>=0.1.0, <1.6.11 · fixed in 1.6.11

Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email

• Authentication bypass
• CWE-345

<1.6.11 · fixed in 1.6.11

Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin

• Authentication bypass
• Broken access control

<1.6.11 · fixed in 1.6.11

Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

• Authentication bypass
• Broken access control

<1.6.11 · fixed in 1.6.11

Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness

• CWE-345

<0.5.0 · fixed in 0.5.0

Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access

• CWE-345
• CWE-441

<2.29.17 || >=2.30.0, <2.32.7 || >=2.33.0, <2.33.8 || >=2.34.0, <2.34.2 · fixed in 2.29.17, 2.32.7, 2.33.8, 2.34.2

SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`

• CWE-345

<2.4.7 || >=2.5.0, <2.5.2 · fixed in 2.4.7, 2.5.2

Zebra has sync restart poisoning from single unauthenticated peer via above-lookahead block

• CWE-345

<7.0.0 · fixed in 7.0.0

OpenClaw: Trusted retry endpoint checks could match hostname prefixes

• CWE-20
• CWE-345

<2026.5.7 · fixed in 2026.5.7

Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components

• Server-side request forgery (SSRF)
• CWE-345

>=0.12.0, <0.12.15 || >=0.13.0, <0.13.11 || >=0.14.0, <0.14.6 || >=0.15.0, <0.15.2 · fixed in 0.12.15, 0.13.11, 0.14.6, 0.15.2

sigstore-js has Insufficient Verification of Data Authenticity

• CWE-345

>=3.1.0, <3.1.1 · fixed in 3.1.1

NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User

• NodeBB
• Authentication bypass
• CWE-345

MyScale MyScaleDB SegmentId.h getCacheKey data authenticity

• MyScaleDB
• CWE-345

volcengine OpenViking Local VectorDB Primary-key Label str_to_uint64.py str_to_uint64 data authenticity

• volcengine OpenViking
• CWE-345

arc53 DocsGPT Credential Storage encryption.py encrypt_credentials data authenticity

• arc53 DocsGPT
• CWE-345

RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request

• metagauss RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
• CWE-345

pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

• CWE-345
• CWE-494

<10.34.2 || >=11.0.0, <11.5.3 · fixed in 10.34.2, 11.5.3

pnpm: Unsafe default behavior breaks integrity check

• CWE-345

<10.34.0 || >=11.0.0, <11.4.0 · fixed in 10.34.0, 11.4.0