CWE-346.

ericc-ch copilot-api Token Endpoint server.ts cors cross-domain policy

• ericc-ch copilot-api
• CWE-346
• CWE-942

pyLoad has a Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)

• CWE-346

<0.5.0b3.dev98 · fixed in 0.5.0b3.dev98

WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses

• CWE-346

<=29.0 · no fixed version yet

farion1231 cc-switch ProxyServer server.rs cross-domain policy

• farion1231 cc-switch
• CWE-346
• CWE-942

Missing Host Header Validation in Apollo MCP Server for Localhost Deployments

• apollographql apollo-mcp-server
• CWE-346

Cross-site request forgery in Google Chrome

• Google Chrome
• Cross-site request forgery (CSRF)
• CWE-346

Origin validation error in Google Chrome

• Google Chrome
• CWE-346

Zammad has an origin validation error in SSO mechanism

• zammad
• CWE-346

Java-SDK has a DNS Rebinding Vulnerability

• CWE-346

<1.0.0 · fixed in 1.0.0

OpenClaw: iOS A2UI bridge trusted generic local-network pages for agent.request dispatch

• Broken access control
• CWE-346

<2026.4.2 · fixed in 2026.4.2

Keycloak vulnerable to information disclosure via CORS header injection due to unvalidated JWT azp claim

• CWE-346

<26.4.13 || >=26.5.0, <26.6.3 · fixed in 26.4.13, 26.6.3

Directus: Missing Cross-Origin Opener Policy

• CWE-346
• CWE-693

<11.17.0 · fixed in 11.17.0

Signal K Server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow

• Open redirect
• CWE-346

>=2.20.0, <2.24.0 · fixed in 2.24.0

OpenClaw: macOS Tailnet DNS Spoofing & Credential Exfiltration

• CWE-346
• CWE-350

<2026.3.31 · fixed in 2026.3.31

OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode

• Cross-site request forgery (CSRF)
• CWE-346

<2026.3.31 · fixed in 2026.3.31

Electron: Incorrect origin passed to permission request handler for iframe requests

• CWE-346

<38.8.6 || >=39.0.0-alpha.1, <39.8.1 || >=40.0.0-alpha.1, <40.8.1 || >=41.0.0-alpha.1, <41.0.0 · fixed in 38.8.6, 39.8.1, 40.8.1, 41.0.0

OpenClaw: Matrix thread root and reply context bypass sender allowlist

• Broken access control
• CWE-346

<2026.3.31 · fixed in 2026.3.31

vanna-ai vanna FastAPI/Flask Server cross-domain policy

• vanna
• CWE-346
• CWE-942

Cross-site request forgery in Google Chrome

• Google Chrome
• Broken access control
• Cross-site request forgery (CSRF)

OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials

• Authentication bypass
• Broken access control

<2026.3.28 · fixed in 2026.3.28

GraphQL API endpoint ignores CORS origin restriction

• CWE-346

>=3.5.0, <8.6.66 || >=9.0.0, <9.7.0-alpha.10 · fixed in 8.6.66, 9.7.0-alpha.10

HAPI FHIR Core has Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect

• CWE-346

<6.9.4 · fixed in 6.9.4

CoCoS attested TLS is vulnerable to relay attacks via extracted ephemeral TLS keys

• ultravioletrs cocos
• CWE-322
• CWE-346

@grackle-ai/server has Missing WebSocket Origin Header Validation

• CWE-346

<0.70.3 · fixed in 0.70.3

Cross-site scripting in Apple Safari and others

• Apple Safari
• Apple iOS and iPadOS
• Cross-site scripting (XSS)
• CWE-346

HCL Traveler is susceptible to a weak default HTTP header validation vulnerability

• HCLSoftware Traveler
• CWE-346

Cryptomator for Android: Tampered vault configuration allows MITM attack on Hub API

• cryptomator android
• CWE-346
• CWE-354

Cryptomator for IOS: Tampered vault configuration allows MITM attack on Hub API

• cryptomator ios
• CWE-346
• CWE-354

Cryptomator: Tampered vault configuration allows MITM attack on Hub API

• cryptomator
• CWE-346
• CWE-354

Improper Authentication and Origin Validation Error in pyload-ng

• Authentication bypass
• CWE-346

<0.5.0b3.dev97 · fixed in 0.5.0b3.dev97

Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation

• CWE-346
• CWE-350

>=2.442, <2.555 · fixed in 2.555

Improper input validation in Apple Safari and others

• Apple Safari
• Apple iOS and iPadOS
• CWE-20
• CWE-346

Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers

• Hard-coded credentials
• CWE-346

<4.5.2 · fixed in 4.5.2

Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding

• CWE-346

<4.5.2 · fixed in 4.5.2

Mattermost allows attackers to spoof permalink embeds

• CWE-346

<5.3.2-0.20260123211116-9efe617be8b8 || >=10.11.0-rc1, <10.11.11 || >=11.2.0-rc1, <11.2.3 || >=11.3.0-rc1, <11.3.1 · fixed in 5.3.2-0.20260123211116-9efe617be8b8, 10.11.11, 11.2.3, 11.3.1

OpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy mode

• CWE-346

<2026.3.11 · fixed in 2026.3.11

Same-origin policy bypass in the CSS Parsing and Computation component

• Mozilla Firefox
• CWE-346

Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation

• CWE-346

>=5.2.0, <5.2.4 · fixed in 5.2.4

Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass

• CWE-346

<9.22.0 · fixed in 9.22.0

Dark Reader gives users the ability to request style sheets from local web servers

• Information disclosure
• CWE-346

<4.9.117 · fixed in 4.9.117

OpenClaw's browser-origin WebSocket auth hardening gap could enable loopback password brute-force chains

• Authentication bypass
• CWE-346

<2026.2.25 · fixed in 2026.2.25

Textream Cross-Site WebSocket Hijacking (CSWSH) vulnerability

• f textream
• CWE-346

calibre has IP Ban Bypass via X-Forwarded-For Header Spoofing

• kovidgoyal calibre
• Authentication bypass
• CWE-346

CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function

• Cross-site scripting (XSS)
• CWE-346

<1.15.3 · fixed in 1.15.3

Storybook Dev Server is Vulnerable to WebSocket Hijacking

• Other injection
• Cross-site scripting (XSS)

>=8.1.0, <8.6.17 || >=8.7.0-alpha.0, <9.1.19 || >=10.0.0-beta.0, <10.2.10 · fixed in 8.6.17, 9.1.19, 10.2.10

Origin validation error in Genetec Inc. Genetec Update Service

• Genetec Inc. Genetec Update Service
• CWE-346

Same-origin policy bypass in the Networking: JAR component

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-346

Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm

• CWE-346

>=4.15.0, <4.18.0 · fixed in 4.18.0

CollabPlatform : CORS Misconfiguration Allows Arbitrary Origin With Credentials Leading to Authenticated Account Data Exposure

• karnop realtime-collaboration-platform
• CWE-346
• CWE-942

Feathers has an origin validation bypass via prefix matching

• CWE-346

<5.0.40 · fixed in 5.0.40

Cache poisoning in @sveltejs/adapter-vercel

• CWE-346

<6.3.2 · fixed in 6.3.2

OpenClaw session tool visibility hardening and Telegram webhook secret fallback

• Information disclosure
• CWE-346

<2026.2.15 · fixed in 2026.2.15

Insufficient Origin Validation in Proctorio Chrome Extension postMessage Handlers

• Proctorio Secure Exam Proctor Extension
• CWE-346

Origin Validation Error in GitLab

• GitLab
• CWE-346

Certain HP OfficeJet Pro Printers - Information Disclosure

• HP Inc HP OfficeJet Pro 8730 All-in-One Printer
• HP Inc HP OfficeJet Pro 8740 All-in-One Printer series
• CWE-346

Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated access to device configuration

• Innomic VibroLine VLX1 HD 5.0
• Innomic VibroLine VLX2 HD 5.0
• CWE-346

AliasVault is Missing Origin Validation in Android Passkey Credential Provider

• aliasvault
• CWE-346

Prowise Reflect v1.0.9 - Remote Keystroke Injection

• Prowise Reflect
• CWE-346

Account Takeover Vulnerability in Appsmith

• appsmith
• CWE-346

MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation

• CWE-346

<3.5.0 · fixed in 3.5.0