Advisories · Weakness
CWE-346.
Every Advisory and CVE whose sources give the weakness CWE-346, newest first.
- CVSS 7.7 High
Vibe-Trading < 0.1.10 - Loopback Trust and Missing Host Validation Enable DNS-Rebinding Authentication Bypass and Remote Code Execution
- HKUDS Vibe-Trading
- CWE-346
- CVSS 6.5 Medium
Origin validation error in Apple Safari and others
- Apple Safari
- Apple iOS and iPadOS
- CWE-346
- CVSS 7.5 High
pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle
- CWE-346
- CWE-693
<10.34.2 || >=11.0.0, <11.5.3 · fixed in 10.34.2, 11.5.3
GHSA-5wx6-mg75-v57r · CVE-2026-55487 - CVSS 6.9 Medium
chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution
- CWE-345
- CWE-346
>=0.9.0, <=1.5.5 · no fixed version yet
GHSA-9g5q-2w5x-hmxf · CVE-2026-72817 - CVSS 8.0 High
LibreChat: Missing Resource Parameter Validation in MCP OAuth Flow
- danny-avila LibreChat
- CWE-346
- CVSS 4.7 Medium
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 3.1 Low
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 4.3 Medium
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 5.3 Medium
Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack
- CWE-346
- CWE-350
<4.5.5 · fixed in 4.5.5
GHSA-w856-8p3r-p338 · CVE-2026-46611 - CVSS 6.3 Medium
Apache NiFi fails to validate proxy host headers when constructing qualified URLs
- CWE-346
<2.10.0 · fixed in 2.10.0
GHSA-8vm2-c32j-mvfr · CVE-2026-54665 - CVSS 2.1 Low
Anki's local HTTP server does not sufficiently validate requests
- Path traversal
- CWE-346
<25.9.3 · fixed in 25.9.3
GHSA-869j-r97x-hx2g · CVE-2026-59153 - CVSS 5.0 Medium
LangSmith SDK TracingMiddleware: Arbitrary server-side file read
- Path traversal
- Memory corruption
<0.8.18 · fixed in 0.8.18
GHSA-f4xh-w4cj-qxq8 · CVE-2026-59152 - CVSS 6.5 Medium
Anki: User scripts in iframes have access to the internal Anki API
- Path traversal
- CWE-346
<25.9.4 · fixed in 25.9.4
GHSA-cw6h-ffmh-x6vh · CVE-2026-58266 - CVSS 8.6 High
Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests
- Cross-site request forgery (CSRF)
- CWE-346
<0.225.2 · fixed in 0.225.2
GHSA-v3f4-w7r7-v3hm · CVE-2026-58497 - CVSS 6.8 Medium
dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens
- Information disclosure
- Authentication bypass
<1.20.0 · fixed in 1.20.0
GHSA-jr33-mw75-7j8f · CVE-2026-55837 - CVSS 7.6 High
TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover
- Cross-site scripting (XSS)
- Open redirect
<3.9.3 · fixed in 3.9.3
GHSA-g5qx-h5f3-mp2f · CVE-2026-55660 - CVSS 6.9 Medium
Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
- Cross-site scripting (XSS)
- Server-side request forgery (SSRF)
>=4.0.0-RC1, <4.18 || >=5.0.0-RC1, <5.10 · fixed in 4.18, 5.10
GHSA-c55v-343g-5xff · CVE-2026-55791 - CVSS 8.6 High
Blocky DNSSEC validation bypass and validation-cache scope pollution
- CWE-346
- CWE-807
>=0.28.0, <0.32.0 · fixed in 0.32.0
GHSA-x845-2f78-7v36 - CVSS 4.0, no score published
Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)
- Denial of service
- CWE-272
<1.8.1 · fixed in 1.8.1
GHSA-v52w-28xh-v562 - CVSS 5.8 Medium
guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts
- CWE-346
- CWE-1286
<7.12.1 · fixed in 7.12.1
GHSA-cwxw-98qj-8qjx · CVE-2026-55767 - CVSS 7.5 High
undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
- CWE-346
- CWE-940
>=7.23.0, <7.28.0 || >=8.0.0, <8.2.0 · fixed in 7.28.0, 8.2.0
GHSA-hm92-r4w5-c3mj · CVE-2026-6734 - CVSS 8.3 High
PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
- Authentication bypass
- Broken access control
>=3.10.0, <4.6.59 · fixed in 4.6.59
GHSA-vmf9-xx9w-86wx · CVE-2026-57112 - CVSS 4.2 Medium
ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider
- CWE-346
<1.80.0-v2.20.0.20260615132747-d184e976fc79 · fixed in 1.80.0-v2.20.0.20260615132747-d184e976fc79
GHSA-g5h5-m4hm-xjrr · CVE-2026-55669 - CVSS 5.3 Medium
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
- CWE-346
- CWE-441
<5.2.5 · fixed in 5.2.5
GHSA-mx8g-39q3-5c79 · CVE-2026-9595 - CVSS 7.1 High
Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
- CWE-346
<0.9.6 · fixed in 0.9.6
GHSA-3vv5-8xxp-4f55 · CVE-2026-54007 - CVSS 9.1 CriticalCritical · CVSS 9+
Same-origin policy bypass in the Networking: Cookies component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
- CVSS 8.6 High
Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations
- Spring Cloud Gateway
- CWE-346
- CVSS 8.8 High
@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass
- Server-side request forgery (SSRF)
- CWE-346
<=18.2.14 || >=19.0.0-next.0, <19.2.23 || >=20.0.0-next.0, <20.3.22 || >=21.0.0-next.0, <21.2.15 || >=22.0.0-next.0, <22.0.0-rc.2 · fixed in 19.2.23, 20.3.22, 21.2.15, 22.0.0-rc.2
GHSA-xrxm-cp7j-8xf6 · CVE-2026-50168 - CVSS 9.4 CriticalCritical · CVSS 9+
MCP Toolbox for Databases has an Origin Validation Error
- CWE-346
<0.25.0 · fixed in 0.25.0
GHSA-76g7-m3xw-x9gr · CVE-2026-11624 - CVSS 8.1 High
Appsmith: Configuration-dependent origin validation bypass in password reset and email verification link generation
- CWE-346
- CWE-807
<2.0 · fixed in 2.0
GHSA-j9gf-vw2f-9hrw - CVSS 8.4 High
Idira Identity Browser Extension: Unauthorized Application Interaction via Origin Validation Failure
- CyberArk Software, a Palo Alto Networks Company Identity Browser Extensions
- CWE-346
- CVSS 3.1 Low
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 6.5 Medium
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 6.5 Medium
@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects
- Information disclosure
- Weak cryptography or TLS
<18.1.2 · fixed in 18.1.2
GHSA-x426-x7cc-3fpc · CVE-2026-48022 - CVSS 8.1 High
Spring for GraphQL: Cross-Site WebSocket Hijacking
- CWE-346
>=2.0.0, <2.0.4 || >=1.4.0, <1.4.6 || >=1.3.0, <=1.3.8 || >=1.0.0, <=1.0.6 · fixed in 2.0.4, 1.4.6
GHSA-m39w-hqxx-3r48 · CVE-2026-41700 - CVSS 7.6 High
Xibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSet
- xibosignage xibo-cms
- Cross-site scripting (XSS)
- CWE-116
- CVSS 9.3 CriticalCritical · CVSS 9+
Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload
- Authentication bypass
- CWE-345
<6.7.22 || >=7.0.0-rc.1, <7.0.0-rc12 · fixed in 6.7.22, 7.0.0-rc12
GHSA-qvv5-jq5g-4cgg · CVE-2026-48063 - CVSS 8.2 High
Insufficient verification that responses belong to a query
- NLnet Labs ldns
- CWE-346
- CVSS 4.3 Medium
Email Spoofing vulnerability in SAP Business Objects Business Intelligence Platform
- SAP_SE SAP Business Objects Business Intelligence Platform
- CWE-346
- CVSS 8.1 High
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 8.7 High
Netty has Insufficient Bailiwick Validation for NS Records
- CWE-345
- CWE-346
>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final
GHSA-5pvg-856g-cp85 · CVE-2026-47691 - CVSS 8.7 High
Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records
- CWE-345
- CWE-346
>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final
GHSA-676x-f7gg-47vc · CVE-2026-45674 - CVSS 7.5 High
Netty's Default QUIC token handler accepts any client-supplied token
- CWE-346
- CWE-940
>=4.2.0.Final, <4.2.15.Final · fixed in 4.2.15.Final
GHSA-cmm3-54f8-px4j · CVE-2026-44894 - CVSS 6.3 Medium
gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection
- CWE-346
>=2.0.0, <2.4.0 · fixed in 2.4.0
GHSA-36w4-95hv-5vwg · CVE-2026-43972 - CVSS 6.5 Medium
sanic-cors contains an improper regular expression in the try_match() function
- CWE-346
- CWE-625
<=2.2.0 · no fixed version yet
GHSA-94jw-hqvj-vw74 · CVE-2026-37737 - CVSS 4.3 Medium
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 4.3 Medium
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 4.3 Medium
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 6.5 Medium
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 5.4 Medium
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 6.5 Medium
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 6.5 Medium
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 6.5 Medium
Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
- CWE-346
- CVSS 6.5 Medium
Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
- CWE-346
- CVSS 6.5 Medium
Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
- CWE-346
- CVSS 6.5 Medium
Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
- CWE-346
- CVSS 6.3 Medium
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 4.3 Medium
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 6.5 Medium
Origin validation error in Google Chrome
- Google Chrome
- CWE-346
- CVSS 4.3 Medium
Origin validation error in Google Chrome
- Google Chrome
- CWE-346