CWE-346.

mcp-go before v1.2.1 Origin Validation Error via Unvalidated Well-Known Protected Resource Metadata

• mark3labs mcp-go
• CWE-346

ChatCLI before v1.215.2 Origin Validation Error via Unvalidated MCP OAuth Resource Indicator

• diillson ChatCLI
• CWE-346

kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts

• Hard-coded credentials
• CWE-346

<1.25.20 · fixed in 1.25.20

Cocos Intra-handshake attested TLS implementation is vulnerable to Diversion Attacks

• ultravioletrs cocos
• CWE-346

GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin

• gpustack
• Authentication bypass
• CWE-346

OmniAuth: Host Header Injection Vulnerability

• omniauth
• CWE-346

SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process execution

• sharpemu
• Authentication bypass
• Cross-site request forgery (CSRF)

Insecure Configuration Vulnerability in Tata Motors iRA and iRA.ev mobile application

• Tata Motors iRA 2.0
• Tata Motors iRA.ev
• CWE-346
• CWE-749

Missing origin validation for the externalbrowser authenticator callback in multiple Snowflake client drivers

• Snowflake Connector for Python
• Snowflake Go Driver
• CWE-346

Origin validation error in better-auth Better Auth

• better-auth Better Auth
• CWE-346

Origin validation error in NAVER Whale browser

• NAVER Whale browser
• CWE-346

Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state

• CWE-346

Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads

• CWE-346
• CWE-942

>=2.52.1, <2.52.3 · fixed in 2.52.3

Ladybird: Missing origin-clean enforcement in CSSStyleSheet allows cross-origin CSS read and mutation

• ladybird
• Information disclosure
• CWE-346

WIT SynApps Runtime 1.4.11 Browser-Mediated SSRF via Controller Onboarding

• WIT SynApps Runtime
• CWE-346

CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching

• cakephp
• CWE-346

Origin validation error in Google Chrome

• Google Chrome
• CWE-346

AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools

• ankimcp anki-mcp-server-addon
• CWE-346
• CWE-350

Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers

• CWE-346

<4.16.0 · fixed in 4.16.0

Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default

• CWE-346

>=4.0.0, <=4.16.2 · no fixed version yet

undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

• CWE-346
• CWE-524

>=7.0.0, <7.30.1 || >=8.0.0, <8.12.2 · fixed in 7.30.1, 8.12.2

AWS API MCP Server OAuth Token Audience Validation Bypass

• aws-api-mcp-server
• CWE-346

Fireware OS Improper Authentication in AuthPoint MFA Verification Allows Session Hijacking

• WatchGuard Fireware OS
• Authentication bypass
• CWE-346

Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation

• CWE-346

<26.10.0rc1 · fixed in 26.10.0rc1

Site isolation issue in the DOM: Navigation component

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-346

Site isolation issue in the Networking: HTTP component

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-346

Same-origin policy bypass in the Address Bar component

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-346

Site isolation issue in the Networking: HTTP component

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-346

Same-origin policy bypass in the CSS Parsing and Computation component

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-346

Same-origin policy bypass in the CSS Parsing and Computation component

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-346

Same-origin policy bypass in the DOM: Navigation component

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-346

Push Endpoint Returns Permissive CORS Headers

• vaadin
• vaadin flow
• CWE-346
• CWE-942

Origin Validation Error Vulnerability in HiRDB

• Hitachi HiRDB Server Version 10
• Hitachi HiRDB Server Version 9
• CWE-346

rathena FluxCP PayPal IPN PaymentNotifyRequest.php verifyiprange origin validation

• rathena FluxCP
• CWE-345
• CWE-346

Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback

• rclone
• CWE-346

MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint

• CWE-346

>=5.0.0-beta.0, <7.1.0 · fixed in 7.1.0

WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr

• zephyr
• Authentication bypass
• CWE-346

obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback

• CWE-346
• CWE-1385

<1.3.1 · fixed in 1.3.1

VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider

• VideoLAN VLC for Android
• CWE-346

Electron: Pointer lock permission requests can be attributed to the wrong frame

• CWE-346

<42.11.9 || >=43.0.0-alpha.1, <43.7.6 || >=44.0.0-alpha.1, <44.5.0 || >=45.0.0-alpha.1, <45.0.0-alpha.13 · fixed in 42.11.9, 43.7.6, 44.5.0, 45.0.0-alpha.13

Electron: openExternal permission requests can be attributed to the wrong origin

• CWE-346

<42.11.3 || >=43.0.0-alpha.1, <43.7.0 || >=44.0.0-alpha.1, <44.3.0 || >=45.0.0-alpha.1, <45.0.0-alpha.5 · fixed in 42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.5

webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades

• webpack-dev-server
• CWE-346
• CWE-1385

Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

• Path traversal
• Code injection

>=8.0.0, <8.6.19 || >=9.0.0, <9.1.21 || >=10.0.0, <10.6.2 || >=11.0.0-alpha.0, <11.0.0-alpha.6 · fixed in 8.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6

Electron: HID and USB permission checks can be attributed to the wrong origin

• CWE-346

<42.11.3 || >=43.0.0-alpha.1, <43.7.0 || >=44.0.0-alpha.1, <44.3.0 || >=45.0.0-alpha.1, <45.0.0-alpha.5 · fixed in 42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.5

Origin validation error in Google Chrome

• Google Chrome
• CWE-346

CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay Attack

• CCC-Attestation attested-tls-poc
• CWE-346

LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files

• CWE-346
• CWE-942

>=0.0.1, <0.4.5 · fixed in 0.4.5

BlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validation

• BlackBeltTechnology pi-agent-dashboard
• CWE-345
• CWE-346

Scoold: CORS wildcard origin with credentials enabled allows cross-origin authenticated API access from any domain

• Erudika scoold
• CWE-346
• CWE-942

AliasVault: Browser extension WebAuthn bridge accepts forged origin/RP ID

• aliasvault
• CWE-346

Angular DevTools (Local DoS)

• angular
• angular DevTools
• CWE-346
• CWE-441

Legacy Update ActiveX control accepts unauthorized hosting origins

• LegacyUpdate
• CWE-346
• CWE-393

Microsoft Security Advisory CVE-2026-96234 - .NET and Visual Studio Information Disclosure Vulnerability

• CWE-346

>=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 || >=11.0.0-preview.1, <11.0.0-rc.2 · fixed in 8.0.32, 9.0.21, 10.0.13, 11.0.0-rc.2

.NET Security Feature Bypass Vulnerability

• Microsoft .NET 10.0 runtime
• Microsoft .NET 11.0 runtime
• CWE-346

Azure Key Vault Information Disclosure Vulnerability

• Microsoft azure-keyvault-administration
• Microsoft azure-keyvault-certificates
• CWE-346

Microsoft Power Apps Remote Code Execution Vulnerability

• Microsoft Power Apps for Android
• CWE-346

Azure DevOps Information Disclosure Vulnerability

• Microsoft Azure CLI
• Microsoft Azure DevOps CLI Extension
• CWE-346

Same-origin policy bypass in the DevTools component

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-346

Site isolation issue in the Networking component

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-346

Saved credentials can be autofilled after cross-origin navigation

• Mozilla Firefox for iOS
• CWE-346