Insufficient Verification of Data Authenticity
CWE-345
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
We track 338 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.4. 2 have been exploited in real attacks.
Latest Insufficient Verification of Data Authenticity vulnerabilities
- 7.5 High severity
XenForo: Insufficient Verification of Data Authenticity
XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid webh
- 9.1 Critical severity
moos-ivp: Insufficient Verification of Data Authenticity
MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on the vehicle bus, allowing any publisher to enroll attacker-controlled shore routes. Attackers can publish malicious shore route messages to receive bridged vehicl
- 9.1 Critical severity
moos-ivp: Insufficient Verification of Data Authenticity
MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses.
- 7.5 High severity
essential-moos: Insufficient Verification of Data Authenticity
MOOS essential-moos through version 10.0.1 contains an unauthenticated UDP packet injection vulnerability in pMOOSBridge when configured with UDPListen. Attackers can send crafted UDP packets to the configured port to inject arbitrary variables into the local
- 9.1 Critical severity
essential-moos: Insufficient Verification of Data Authenticity
MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that accepts UDP datagrams from any source and republishes them with the attacker-claimed identity intact. Attackers can send crafted UDP datagrams to pShare input rou
- 7.5 High severity
moos-ivp: Insufficient Verification of Data Authenticity
MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection source. Attackers can craft NODE_MESSAGE packets with spoofed source identities to impersonate other nodes and post arbitr
- 7.1 High severity
medplum: Insufficient Verification of Data Authenticity
Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redire
- 7.7 High severity
AMD Ryzen™ 3000 Series Desktop Processors: Insufficient Verification of Data Authenticity
Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM data potentially resulting in denial of service or privilege escalation.
- 8.1 High severity
Telerik UI for ASP.NET AJAX: Insufficient Verification of Data Authenticity
In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders th
- 9.8 Critical severity
drift: Insufficient Verification of Data Authenticity
@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to
- 9.4 Critical severity
Google Cloud Build: Insufficient Verification of Data Authenticity
An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression. This vulnerabi
- 8.3 High severity
Magma: Insufficient Verification of Data Authenticity
A vulnerability was identified in Linux Foundation Magma 1.9.0. This affects an unknown function of the component SecurityModeComplete Handler. Such manipulation leads to improper validation of integrity check value. The attack may be launched remotely. The ex
- 7.6 High severity
IGEL OS 12: Insufficient Verification of Data Authenticity
IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned configuration a
- 9.8 Critical severity
openssl_encrypt: Insufficient Verification of Data Authenticity
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining
- 7.4 High severity
Apache Hive: Improper Authentication
An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 (and later unreleased branches) on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network
- 8.3 High severity
arc: Missing Authentication for Critical Functionality
Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at `internal/cluster/replication/receiver.go` validates only the wire-format envelope (length, opcode) of inbound messages. T
- 8.3 High severity
arc: Improper Limitation of a Pathname to a Restricted Directory
Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's Raft FSM (`internal/cluster/raft/fsm.go:applyRegisterFile`) accepts attacker-chosen file paths in manifest-registration proposals without validating them
- 8.7 High severity
Red Hat Advanced Cluster Management for…: Insufficient Verification of Data Authenticity
A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by c
- 8.7 High severity
Red Hat Advanced Cluster Management for…: Insufficient Verification of Data Authenticity
A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect network traffic from other connected clusters (peer clusters) by publishing a specially crafted network endpoint. The system fails to properly validate the networ
- 7.6 High severity
samly: Insufficient Verification of Data Authenticity
Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested. Samly.SPHandler.validate_authresp/3 in lib/samly/sp_handler.ex va
- 7.1 High severity
stigmem: Insufficient Verification of Data Authenticity
stigmem (pip package stigmem-node) version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incorrectly treated as expired. This affects the availability and reliability of authenticated
- 7.7 High severity
BetterDesk: Authentication Bypass by Capture-replay
BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha conta
- 7.0 High severity
Kong Mesh: Insufficient Verification of Data Authenticity
On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones ca
- 9.1 Critical severity
openssl_encrypt: Insufficient Verification of Data Authenticity
openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private networks can forge client certificate headers to bypass mTLS aut
- 9.8 Critical severity
openssl_encrypt: Insufficient Verification of Data Authenticity
openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypas
- 8.1 High severity
artifactory: Insufficient Verification of Data Authenticity
An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability.
- 7.5 High severity
OpenSign: Insufficient Verification of Data Authenticity
An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to forge document audit-trail entries via the triggerevent Parse cloud function. The function accepts viewer identity and IP address as call
- 8.8 High severity
cyberpanel: Insufficient Verification of Data Authenticity
CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated remote code execution vulnerability in the remote backup feature that allows authenticated attackers to gain root-level SSH access by supplying a malicious remote server address. Attackers ca
- 8.5 High severity
Multicluster Global Hub 1.4.9: Insufficient Verification of Data Authenticity
A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can mani
- 7.1 High severity
klever-go: Insufficient Verification of Data Authenticity
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, header signature verification counts the unused padding bits of the PubKeysBitmap toward the two-thirds validator quorum. These padding bits do not correspond to any validat
- 8.6 High severity
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within…
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, the `$import-pnp` operation in Pathling Server accepts a caller-supplied `exportUrl` and uses it as the
- 7.5 High severity
Integrate PhonePe with WooCommerce: Insufficient Verification of Data Authenticity
The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the order being marked as paid, nor does it verify the authenticity of its payment-completion request, allowing unauthenticat
- 9.1 Critical severity
Apache CXF: Insufficient Verification of Data Authenticity
Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued I
- 9.1 Critical severity
Apache CXF: Insufficient Verification of Data Authenticity
Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT (e.g., one whose client_secret is known o
- 9.3 Critical severity
Baileys: Authentication Bypass by Spoofing
Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baileys session can be sent a malicious payload via the placeholderResendMessage and trigger a fake messages.upsert event with a fake message key
- 9.1 Critical severity
@fastify/aws-lambda: Insufficient Verification of Data Authenticity
@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the defaul
- 7.7 High severity
wazuh: Insufficient Verification of Data Authenticity
Wazuh 5.0.0-beta1 (fixed in 5.0.0-beta3) does not validate or override the cluster_name and cluster_node fields in inventory-sync Start FlatBuffer messages, while validating only the agentid against the authenticated agent identity. This allows a low-privilege
- 8.5 High severity
Red Hat Advanced Cluster Security 4: Insufficient Verification of Data Authenticity
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). When processing Kubernetes Deployments, ACS replaces deployment identity metadata based on the openshift.io/encoded-deployment-config label. A user with permission to create Deployme
- 7.6 High severity
Gleam: Insufficient Verification of Data Authenticity
Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verif
- 7.5 High severity
Red Hat Ansible Automation Platform 2.5 for…: Insufficient Verification of Data Authenticity
A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access controls (permission_classes=[AllowAny], authentication_classes=[]) and relies solely on the Subject HTTP header value for mTLS authentication with