CWE-345.

PyJWT accepts unknown `crit` header extensions

• Weak cryptography or TLS
• Broken access control

<2.12.0 · fixed in 2.12.0

ZeptoClaw: Email Sender Spoofing to bypass Header-Only From Allowlist Validation

• Authentication bypass
• CWE-345

<0.7.6 · fixed in 0.7.6

ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload data

• Authentication bypass
• CWE-345

<0.7.6 · fixed in 0.7.6

An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile

• Authentication bypass
• Broken access control

Windows App Installer Spoofing Vulnerability

• Microsoft Windows App Client for Windows Desktop
• CWE-345

OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding

• Broken access control
• CWE-345

<10.0.19 · fixed in 10.0.19

mkj Dropbear S Range Check curve25519.c unpackneg signature verification

• mkj Dropbear
• Weak cryptography or TLS
• CWE-345

Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation

• Authentication bypass
• CWE-345

>=2.10.0, <2.11.2 · fixed in 2.11.2

Pingora vulnerable to cache poisoning via insecure-by-default cache key

• Broken access control
• CWE-345

<0.8.0 · fixed in 0.8.0

OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes

• Authentication bypass
• CWE-345

<0.0.0-20260304231339-e97d8ecbd8d6 · fixed in 0.0.0-20260304231339-e97d8ecbd8d6

Gogs: Cross-repository LFS object overwrite via missing content hash verification

• CWE-345

<0.14.2 · fixed in 0.14.2

RustDesk Client Accepts Unauthenticated stop-service Command via Strategy Payload

• rustdesk-client RustDesk Client
• CWE-345
• CWE-755

RustDesk Client Blindly Merges Unauthenticated Strategy Payloads, Bypassing Local Security Settings

• rustdesk-client RustDesk Client
• CWE-345

OpenClaw's voice-call Twilio replay dedupe now bound to authenticated webhook identity

• Authentication bypass
• CWE-345

<2026.2.26 · fixed in 2026.2.26

OpenClaw improperly parses X-Forwarded-For behind trusted proxies allows client IP spoofing in security decisions

• CWE-345
• CWE-807

<2026.2.21 · fixed in 2026.2.21

Dataease SQLBot JWT Token auth.py validateEmbedded signature verification

• Dataease SQLBot
• Weak cryptography or TLS
• CWE-345

An authenticated arbitrary file upload vulnerability in Cohesity TranZman Migration Appliance Release 4.0 Build 14614 allows attackers with Administrator privileges to execute arbitrary code via uplo…

• CWE-345

Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Payment Status modification

• techjewel Fluent Forms Pro Add On Pack
• CWE-345

Unitree Go2 Mobile Program Tampering Enables Root RCE

• UnitreeRobotics Unitree Go2
• CWE-345

Improper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME_1.00 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user.

• Authentication bypass
• CWE-345

Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter

• Weak cryptography or TLS
• CWE-345

<8.6.3 || >=9.0.0, <9.3.1-alpha.4 · fixed in 8.6.3, 9.3.1-alpha.4

Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo

• Authentication bypass
• CWE-345

>=4.12.0, <4.12.2 · fixed in 4.12.2

Cesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verification

• Cesanta Mongoose
• Weak cryptography or TLS
• CWE-345

The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Unauthenticated Email Relay

• posimyththemes The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce
• CWE-345

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment

• metagauss RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
• CWE-345

OpenClaw inter-session prompts could be treated as direct user instructions

• CWE-345

<2026.2.13 · fixed in 2026.2.13

OpenClaw allows unauthenticated discovery TXT records to steer routing and TLS pinning

• CWE-345

<2026.2.14 · fixed in 2026.2.14

OpenClaw has a potential access-group authorization bypass if channel type lookup fails

• Broken access control
• CWE-345

<2026.2.1 · fixed in 2026.2.1

OpenClaw optional voice-call plugin: webhook verification may be bypassed behind certain proxy configurations

• Authentication bypass
• CWE-345

<=2026.1.24 · no fixed version yet

OpenClaw has a Telegram webhook request forgery (missing `channels.telegram.webhookSecret`) → auth bypass

• CWE-345

<2026.2.1 · fixed in 2026.2.1

cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

• CWE-345
• CWE-354

<46.0.5 · fixed in 46.0.5

Microsoft Exchange Server Spoofing Vulnerability

• Microsoft Exchange Server 2016 Cumulative Update 23
• Microsoft Exchange Server 2019 Cumulative Update 14
• CWE-345
• CWE-451

EVE Doesn't Protect Rootfs

• CWE-345

<0.0.0-20220708121648-5fef4d92e758 · fixed in 0.0.0-20220708121648-5fef4d92e758

OpenProject has Forced Actions, Content Spoofing, and Persistent DoS via ID Manipulation in OpenProject Blocknote Editor Extension

• opf openproject
• CWE-345

OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server

• opf openproject
• CWE-345

sm-crypto Affected by Private Key Recovery in SM2-PKE

• CWE-345

<0.3.14 · fixed in 0.3.14

MineAdmin improperly refreshes tokens

• CWE-345

>=1.0.0, <=2.0.3 · no fixed version yet

Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.2 - Unauthenticated Order Status Manipulation

• linknacional Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit
• CWE-345

Cosign verification accepts any valid Rekor entry under certain conditions

• CWE-345

<2.6.2 · fixed in 2.6.2

Insufficient verification of data authenticity in TECNO Mobile com.afmobi.boomplayer

• TECNO Mobile com.afmobi.boomplayer
• CWE-345

Auth0 Symfony SDK has Improper Audience Validation via Auth0-PHP SDK

• Broken access control
• CWE-345

>=5.0.0, <5.6.0 · fixed in 5.6.0

cpp-httplib Untrusted HTTP Header Handling: Internal Header Shadowing (REMOTE*/LOCAL*)

• yhirose cpp-httplib
• Authentication bypass
• CWE-345

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate attacker with root access to modify the Rec…

• CWE-345

OrangeHRM is Vulnerable to Account Takeover Through Unvalidated Username in Password Reset Workflow

• orangehrm
• CWE-20
• CWE-345

Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions

• Authentication bypass
• Weak cryptography or TLS

>=1.3.34, <1.4.0 · fixed in 1.4.0

Unauthenticated Arbitrary File Upload (upgrade_contents.php)

• DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter
• CWE-345

cggmp21 has a missing check in the ZK proof used in CGGMP21

• Weak cryptography or TLS
• CWE-345

<0.6.3 · fixed in 0.6.3

Subscriptions & Memberships for PayPal <= 1.1.7 - Unauthenticated Fake Payment Creation

• scottpaterson Subscriptions & Memberships for PayPal
• CWE-345

eGovFramework <= 4.3.1 Unauthenticated Encryption Oracle via Web Editor Image Upload Endpoints

• eGovFramework/egovframe-common-components
• CWE-345

AstrBot is vulnerable to RCE with hard-coded JWT signing keys

• Hard-coded credentials
• CWE-345

<3.5.18 · fixed in 3.5.18

MantisBT lacks verification when changing a user's email address

• Information disclosure
• CWE-345

<2.27.2 · fixed in 2.27.2

D-Link DAP-2695 Firmware Update sub_40C6B8 signature verification

• D-Link DAP-2695
• Weak cryptography or TLS
• CWE-345

Intent Abuse in Google Messages for Wear OS for Silent Message Sending

• Google WearOS
• CWE-345

chatwoot Widget IFrameHelper.js initPostMessageCommunication origin validation

• chatwoot
• CWE-345
• CWE-346

An issue in the firmware update mechanism of Nous W3 Smart WiFi Camera v1.33.50.82 allows unauthenticated and physically proximate attackers to escalate privileges to root via supplying a crafted upd…

• CWE-345

Rapid7 AppSpider Project Name Validation Bypass

• Rapid7 AppSpider Pro
• CWE-20
• CWE-345

Formbricks missing JWT signature verification

• formbricks
• Authentication bypass
• Weak cryptography or TLS

Rancher CLI SAML authentication is vulnerable to phishing attacks

• CWE-345

>=2.9.0, <2.9.12 || >=2.10.0, <2.10.10 || >=2.11.0, <2.11.6 || >=2.12.0, <2.12.2 · fixed in 2.9.12, 2.10.10, 2.11.6, 2.12.2

Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)

• Broken access control
• CWE-345

<1.6.4 · fixed in 1.6.4

matrix-js-sdk has insufficient validation when considering a room to be upgraded by another

• Broken access control
• CWE-20

<38.2.0 · fixed in 38.2.0