CWE-345.

joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json

• authlib joserfc
• Authentication bypass
• Weak cryptography or TLS

Discourse ActivityPub: Fix inbound actor validation and apply outbound request SSRF hardening

• discourse-activity-pub
• Broken access control
• CWE-345

Rede Itaú for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Order Status Manipulation via maxiPago Debit Webhook

• Rede Itaú for WooCommerce
• CWE-345

Rede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order Status Manipulation via 3DS Failure Webhook

• Rede Itaú for WooCommerce
• CWE-345

Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Project Secret

• Cardinity Payment Gateway for WooCommerce
• CWE-345

FileRise OIDC login can bind an attacker identity to an existing local account

• error311 FileRise
• Authentication bypass
• CWE-345

Gitea required Actions check bypass through skipped workflows

• Gitea
• Broken access control
• CWE-345

BizSpring Shop through commit cf22d39daaf1 Payment Bypass via test_post_pay Endpoint

• BizSpring Shop
• BizSpring Java Mall
• CWE-345

Tickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPN

• Tickera
• CWE-345

WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal Commerce

• WPForms Lite
• CWE-345

Visma Pay for WooCommerce < 1.2.2 - Unauthenticated Payment Bypass and Order Data Disclosure via Gateway Return Endpoint

• Visma Pay for WooCommerce
• CWE-345

Sunshine Photo Cart < 3.7.4 - Unauthenticated Content Injection via sunshine_modal_add_comment()

• Sunshine Photo Cart
• CWE-345

LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored HTML Injection via Checkout Error Message

• LTL Freight Quotes
• CWE-345

Insufficient verification of data authenticity in Schneider Electric Sage RTU 1410 and others

• Schneider Electric Sage RTU 1410
• Schneider Electric Sage RTU 1430
• CWE-345

D-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature verification

• D-Link DCS-930L
• Weak cryptography or TLS
• CWE-345

Code for IBMi: Uses IBM i components with blind check allowing arbitrary code execution

• codefori vscode-ibmi
• Broken access control
• CWE-345

Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies

• ZcashFoundation zebra
• CWE-345

Contrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Exposure via Peer Recovery

• edgelesssys contrast
• CWE-345

InstantSoft icms2 Billing paypal.php validatePaypalOrder data authenticity

• InstantSoft icms2
• CWE-345

WordPress Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway plugin <= 1.7.2 - Bypass Vulnerability vulnerability

• Narinder Singh Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway
• CWE-345

Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

• Authentication bypass
• CWE-345

>=1.0.0, <2.4.0 · fixed in 2.4.0

Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment (payment forgery)

• Jexactyl
• CWE-345

IBM DataPower Gateway Insufficient Verification of Data Authenticity

• IBM DataPower Gateway 10.6CD
• IBM DataPower Gateway 10.6.0
• CWE-345

Airwallex Online Payments Gateway < 1.36.0 - Unauthenticated Payment Bypass via Forged Webhook

• Airwallex Online Payments Gateway
• CWE-345

AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check

• AsyncHttpClient async-http-client
• CWE-345
• CWE-670

Vault PKI ACME Issues Certificate With Unvalidated SANs

• HashiCorp Vault
• HashiCorp Vault Enterprise
• CWE-345

Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write

• Authentication bypass
• CWE-345

>=1.5.0, <1.10.3 · fixed in 1.10.3

PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing

• Authentication bypass
• Broken access control

<4.6.78 · fixed in 4.6.78

Account Takeover Vulnerability in Manacle Technologies ERP System

• Manacle Technologies Multi-tenant ERP System
• CWE-345

Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Bypass via NPG Notification Handler

• Nexi XPay Build
• CWE-345

wolfSSH ECDSA host key curve not validated against negotiated algorithm

• wolfSSL Inc. wolfSSH
• CWE-345

MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

• Hard-coded credentials
• CWE-345

>=2.0.0, <2.2.0 · fixed in 2.2.0

Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions

• Cloud Foundry UAA
• Cloud Foundry cf-deployment
• CWE-345

PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

• CWE-345
• CWE-348

>=2.1.0, <2.15.0 · fixed in 2.15.0

Mitel MiVoice Office 400 Backup Restoration Arbitrary File Write Leading to Root Code Execution

• Mitel MiVoice Office 400
• Path traversal
• Unrestricted file upload

invariant-systems-ai aiir Policy Gate signature verification

• invariant-systems-ai aiir
• Weak cryptography or TLS
• CWE-345

OpenPGP data signature accepted from a signing subkey without cross-certification

• Legion of the Bouncy Castle Inc. BC-JAVA
• Weak cryptography or TLS
• CWE-345

OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check

• Legion of the Bouncy Castle Inc. BC-JAVA
• Legion of the Bouncy Castle Inc. BC-LTS-JAVA
• CWE-345
• CWE-354

Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite

• ZcashFoundation zebra
• CWE-345

Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes

• ZcashFoundation zebra
• CWE-345

Apache Directory LDAP API: Injection of plaintext responses during StartTLS

• Apache Software Foundation Apache Directory LDAP API
• CWE-345

CVE-2026-104056

• Authlib
• CWE-345
• CWE-346

JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

• Cross-site scripting (XSS)
• CWE-345

>=7.5.0, <7.6.3 · fixed in 7.6.3

Kiteworks Core Insufficient Verification of Data Authenticity

• Kiteworks Core
• CWE-345

UltrafastSecp256k1: ECDSA adaptor verification accepts non-adaptable pre-signatures due to missing DLEQ binding

• shrec UltrafastSecp256k1
• Weak cryptography or TLS
• CWE-345

Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection

• Apache Software Foundation Apache WSS4J
• CWE-345

Editor can forge file-provisioning provenance on dashboards via the dashboard API

• Grafana OSS
• Grafana Enterprise
• Broken access control
• CWE-345

PyJWT: PyJWKClient follows redirects when fetching JWKS

• Information disclosure
• Server-side request forgery (SSRF)

<2.14.0 · fixed in 2.14.0

undici vulnerable to caching and replay of unsafe HTTP method responses

• CWE-345

>=7.0.0, <7.29.1 || >=8.0.0, <8.10.2 · fixed in 7.29.1, 8.10.2

Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

• CWE-20
• CWE-345

>=42.3.3, <42.10.0 || >=43.0.0-beta.1, <43.5.0 || >=44.0.0-alpha.1, <44.0.0-beta.6 · fixed in 42.10.0, 43.5.0, 44.0.0-beta.6

Out-of-bounds Read and Unverified Entry Pointers in the ThreadX Module Loader

• Eclipse Foundation Eclipse ThreadX
• Memory corruption
• CWE-345

Trusted Domain Project OpenDMARC PSL Wildcard opendmarc_tld.c : opendmarc_get_tld origin validation

• Trusted Domain Project OpenDMARC
• CWE-345
• CWE-346

Verge3D 4.1.0 - 4.13.0 - Unauthenticated Payment Bypass via v3d_payment_done

• Verge3D Publishing and E-Commerce
• CWE-345

Paymattic < 4.6.26 - Unauthenticated Payment Bypass via Unbound Stripe PaymentIntent

• Paymattic
• CWE-345

FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

• CWE-345

<1.7.4 || >=2.0.0-beta.1, <2.0.0-beta.4 · fixed in 1.7.4, 2.0.0-beta.4

Botslab G980H Dashcams Insufficient Verification of Data Authenticity

• Botslab G980H
• CWE-345

authentik: Authentication bypass via assertion confusion in SAML sources

• authentik
• Authentication bypass
• CWE-345

Paymob for WooCommerce < 4.1.14 - Unauthenticated Payment Bypass via Unverified Subscription Transaction Callback

• Paymob for WooCommerce
• CWE-345

MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions

• MasterStudy LMS WordPress Plugin
• CWE-345

SolarWinds Observability Self-Hosted Remote Code Execution Vulnerability

• SolarWinds Observability Self-Hosted
• CWE-345