Advisories · Weakness
CWE-346.
Every Advisory and CVE whose sources give the weakness CWE-346, newest first.
- CVSS 6.5 Medium
Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
- CWE-346
- CVSS 6.5 Medium
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 6.5 Medium
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 6.5 Medium
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 6.5 Medium
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 6.5 Medium
Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
- CWE-346
- CVSS 6.5 Medium
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 8.1 High
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 6.3 Medium
AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle
- Weak cryptography or TLS
- Race condition
<0.107.75 · fixed in 0.107.75
GHSA-xgx4-4h9w-53pv · CVE-2026-47703 - CVSS 6.6 Medium
AIOHTTP is vulnerable to cross-origin redirect with per-request cookies
- CWE-346
<3.14.0 · fixed in 3.14.0
GHSA-hg6j-4rv6-33pg · CVE-2026-47265 - CVSS 6.1 Medium
Duplicate Advisory: jupyter-server is vulnerable to CORS origin validation bypass when the `allow_origin_pat` configuration is used
- CWE-346
>=1.12.0, <=2.17.0 · no fixed version yet
GHSA-v42x-x7jp-845h · CVE-2026-6657 - CVSS 5.4 Medium
NamelessMC: OAuth callback `state` is not validated, allowing login CSRF / session swapping
- Nameless
- Cross-site request forgery (CSRF)
- CWE-302
- CVSS 8.3 High
Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection
- home-assistant core
- Home Assistant Companion app (iOS)
- Code injection
- CWE-346
- CVSS 5.0 Medium
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 6.3 Medium
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 6.0 Medium
RustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on console
- rustfs
- Authentication bypass
- CWE-346
- CVSS 6.1 Medium
Origin validation error in Synology Assistant
- Synology Assistant
- CWE-346
- CVSS 6.1 Medium
Origin validation error in Synology Active Backup for Business Agent
- Synology Active Backup for Business Agent
- CWE-346
- CVSS 6.1 Medium
Origin validation error in Synology ActiveProtect Agent
- Synology ActiveProtect Agent
- CWE-346
- CVSS 10.0 CriticalCritical · CVSS 9+
Microsoft Entra ID Elevation of Privilege Vulnerability
- Microsoft Entra
- CWE-346
- CVSS 7.6 High
Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret
- CWE-346
<5.4.5 · fixed in 5.4.5
GHSA-j3vx-cx2r-pvg8 · CVE-2026-46701 - CVSS 7.8 High
Origin validation error in Trend Micro, Inc. TrendAI Apex One and others
- Trend Micro, Inc. TrendAI Apex One
- Trend Micro, Inc. TrendAI Apex One as a Service
- CWE-346
- CVSS 7.8 High
Origin validation error in Trend Micro, Inc. TrendAI Apex One and others
- Trend Micro, Inc. TrendAI Apex One
- Trend Micro, Inc. TrendAI Apex One as a Service
- CWE-346
- CVSS 7.8 High
Origin validation error in Trend Micro, Inc. TrendAI Apex One and others
- Trend Micro, Inc. TrendAI Apex One
- Trend Micro, Inc. TrendAI Apex One as a Service
- CWE-346
- CVSS 7.8 High
Origin validation error in Trend Micro, Inc. TrendAI Apex One and others
- Trend Micro, Inc. TrendAI Apex One
- Trend Micro, Inc. TrendAI Apex One as a Service
- CWE-346
- CVSS 7.8 High
Origin validation error in Trend Micro, Inc. TrendAI Apex One and others
- Trend Micro, Inc. TrendAI Apex One
- Trend Micro, Inc. TrendAI Apex One as a Service
- CWE-346
- CVSS 7.8 High
Origin validation error in Trend Micro, Inc. TrendAI Apex One and others
- Trend Micro, Inc. TrendAI Apex One
- Trend Micro, Inc. TrendAI Apex One as a Service
- CWE-346
- CVSS 7.8 High
Origin validation error in Trend Micro, Inc. TrendAI Apex One (Mac)
- Trend Micro, Inc. TrendAI Apex One (Mac)
- CWE-346
- CVSS 7.8 High
Origin validation error in Trend Micro, Inc. TrendAI Apex One (Mac)
- Trend Micro, Inc. TrendAI Apex One (Mac)
- CWE-346
- CVSS 7.8 High
Origin validation error in Trend Micro, Inc. TrendAI Apex One and others
- Trend Micro, Inc. TrendAI Apex One
- Trend Micro, Inc. TrendAI Apex One as a Service
- CWE-346
- CVSS 6.9 Medium
Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage
- CWE-346
- CWE-942
<3.1.2 · fixed in 3.1.2
GHSA-m837-xvxr-vqwg · CVE-2026-56277 - CVSS 6.6 Medium
Another 'ghost domain names' attack variant
- NLnet Labs Unbound
- CWE-346
- CVSS 4.0, no score published
MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path
- Authentication bypass
- Broken access control
<0.7.0 · fixed in 0.7.0
GHSA-g53w-w6mj-hrpp - CVSS 9.6 CriticalCritical · CVSS 9+
MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution
- CWE-346
- CWE-940
>=3.9.0, <3.10.0 · fixed in 3.10.0
GHSA-67c5-x5mf-rppq · CVE-2026-2611 - CVSS 6.5 Medium
Same-origin policy bypass in the Networking: JAR component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
- CVSS 9.3 CriticalCritical · CVSS 9+
Same-origin policy bypass in the Networking: HTTP component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
- CVSS 4.3 Medium
Mattermost doesn't validate the X-Requested-With header on the burn-on-read reveal endpoint
- CWE-346
<5.3.2-0.20260327001745-7a339a6438f5 · fixed in 5.3.2-0.20260327001745-7a339a6438f5
GHSA-xvcx-mgpc-5xh3 · CVE-2026-6339 - CVSS 8.2 High
Origin validation error in denx U-Boot
- denx U-Boot
- CWE-346
- CVSS 5.1 Medium
Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin
- CWE-346
- CWE-942
<2.7.25 || >=2.9.0, <2.9.15 || >=2.11.0, <2.11.13 || >=2.12.0, <2.12.10 || >=2.13.0, <2.13.5 · fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, 2.13.5
GHSA-3vcp-chfh-f6r2 · CVE-2026-18676 - CVSS 7.5 High
stale custom cookie host causes cookie leak
- curl
- CWE-346
- CVSS 9.8 CriticalCritical · CVSS 9+
SillyTavern has Authentication Bypass via SSO Header Injection
- Authentication bypass
- CWE-346
<1.18.0 · fixed in 1.18.0
GHSA-gxx6-h3g6-vwjh · CVE-2026-44649 - CVSS 8.0 High
Cleanuparr: Reflective CORS combined with trusted-network auth allows cross-origin admin API reads
- Cleanuparr
- CWE-346
- CWE-942
- CVSS 9.1 CriticalCritical · CVSS 9+
Unity Catalog has a JWT Issuer Validation Bypass tht Allows Complete User Impersonation
- Authentication bypass
- CWE-346
<0.4.1 · fixed in 0.4.1
GHSA-qqcj-rghw-829x · CVE-2026-27478 - CVSS 8.7 High
Dozzle's Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpointsbypasses authentication
- CWE-346
<=10.5.1 · no fixed version yet
GHSA-j643-x8pv-8m67 · CVE-2026-44985 - CVSS 4.0, no score published
@cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry
- Hard-coded credentials
- CWE-346
>=9.9.5, <12.3.3 · fixed in 12.3.3
GHSA-qhh4-458h-xwh2 - CVSS 9.8 CriticalCritical · CVSS 9+
RCE in TUBITAK BILGEM's Liderahenk
- TUBITAK BILGEM Software Technologies Research Institute Liderahenk
- CWE-346
- CVSS 4.3 Medium
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 4.3 Medium
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 4.7 Medium
Origin validation error in Oracle Corporation Oracle Macaron Tool of Oracle Open Source Projects
- Oracle Corporation Oracle Macaron Tool of Oracle Open Source Projects
- CWE-346
- CVSS 7.3 High
Apache Thrift vulnerable to Path Traversal, HTTP Request/Response Splitting, Uncontrolled Resource Consumption
- Path traversal
- Other injection
<=0.22.0 · no fixed version yet
GHSA-526f-jxpj-jmg2 · CVE-2026-43870 - CVSS 2.3 Low
OpenClaw: Slack thread context could include messages from non-allowlisted senders
- CWE-346
<2026.4.2 · fixed in 2026.4.2
GHSA-qm77-8qjp-4vcm · CVE-2026-41358 - CVSS 5.3 Medium
ChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policy
- ChatGPTNextWeb NextChat
- CWE-346
- CWE-942
- CVSS 5.3 Medium
alexta69 MeTube CORS Policy main.py on_prepare cross-domain policy
- alexta69 MeTube
- CWE-346
- CWE-942
- CVSS 4.8 Medium
AgentFlow Local Web API Content-Type Validation Bypass
- berabuddies AgentFlow
- CWE-346
- CVSS 8.8 High
DNS rebinding vulnerability in rmcp Streamable HTTP server transport
- CWE-346
- CWE-350
>=0.0.0-0, <1.4.0 · fixed in 1.4.0
GHSA-fvh2-gm75-j4j7 · CVE-2026-42559 - CVSS 5.6 Medium
Sensitive Information Disclosure Vulnerability Caused by Trusted Domain Bypass in OPPO Wallet
- OPPO Wallet APP
- CWE-346
- CVSS 5.4 Medium
Duplicate Advisory: OpenClaw: Slack thread context could include messages from non-allowlisted senders
- CWE-346
<2026.4.2 · fixed in 2026.4.2
GHSA-7hrg-5w46-5r2x - CVSS 7.3 High
Duplicate Advisory: OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials
- CWE-346
<2026.3.28 · fixed in 2026.3.28
GHSA-gv2f-q4wp-fvh5 - CVSS 8.7 High
Path Traversal Vulnerability in LabOne User Interface
- Zurich Instruments LabOne
- Path traversal
- CWE-346
- CVSS 7.5 High
locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor
- Cross-site scripting (XSS)
- CWE-346
<4.0.21 · fixed in 4.0.21
GHSA-w937-fg2h-xhq2 · CVE-2026-41886