Insufficient Verification of Data Authenticity
CWE-345
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
We track 338 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.4. 2 have been exploited in real attacks.
Latest Insufficient Verification of Data Authenticity vulnerabilities
- 9.1 Critical severity
parse-server: Use of a Broken or Risky Cryptographic Algorithm
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.3 and 9.1.1-alpha.4, an unauthenticated attacker can forge a Google authentication token with `alg: "none"` to log in as any user link
- 7.5 High severity
hono: Authentication Bypass by Spoofing
Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter (`hono/aws-lambda`) behind an Application Load Balancer (ALB), the `getConnInfo()` function incorrectly selec
- 7.5 High severity
openclaw: Insufficient Verification of Data Authenticity
OpenClaw is a personal AI assistant. In versions 2026.1.30 and below, if channels.telegram.webhookSecret is not set when in Telegram webhook mode, OpenClaw may accept webhook HTTP requests without verifying Telegram’s secret token header. In deployments where
- 7.3 High severity
openproject: Insufficient Verification of Data Authenticity
OpenProject is an open-source, web-based project management software. In the new editor for collaborative documents based on BlockNote, OpenProject maintainers added a custom extension in OpenProject version 17.0.0 that allows to mention OpenProject work packa
- 9.0 Critical severity
openproject: Insufficient Verification of Data Authenticity
OpenProject is an open-source, web-based project management software. To enable the real time collaboration on documents, OpenProject 17.0 introduced a synchronization server. The OpenPrioject backend generates an authentication token that is currently valid f
- 9.1 Critical severity
sm-crypto: Insufficient Verification of Data Authenticity
sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto prior to version 0.3.14. By interacting with the SM2 decryption interf
- 7.5 High severity
MineAdmin: Insufficient Verification of Data Authenticity
A weakness has been identified in MineAdmin 1.x/2.x. This impacts the function refresh of the file /system/refresh of the component JWT Token Handler. This manipulation causes insufficient verification of data authenticity. It is possible to initiate the attac
- 9.8 Critical severity
com.afmobi.boomplayer: Insufficient Verification of Data Authenticity
Insufficient Verification of Data Authenticity vulnerability in TECNO Mobile com.Afmobi.Boomplayer allows Authentication Bypass.This issue affects com.Afmobi.Boomplayer: 7.4.63.
- 9.8 Critical severity
cpp-httplib: Authentication Bypass by Spoofing
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can inject header
- 8.8 High severity
orangehrm: Weak Password Recovery Mechanism for Forgotten Password
OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the password reset workflow does not enforce that the username submitted in the final reset request matches the account for which the reset process was originally ini
- 9.8 Critical severity
Mozart FM Transmitter: Unrestricted Upload of File with Dangerous Type
Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Missing signature validation allows u
- 9.3 Critical severity
cggmp21: Insufficient Verification of Data Authenticity
CGGMP24 is a state-of-art ECDSA TSS protocol that supports 1-round signing (requires 3 preprocessing rounds), identifiable abort, and a key refresh protocol. Prior to version 0.6.3, there is a missing check in the ZK proof that enables an attack in which singl
- 8.7 High severity
eGovFramework/egovframe-common-components: Insufficient Verification of Data Authenticity
eGovFramework/egovframe-common-components versions up to and including 4.3.1 includes Web Editor image upload and related file delivery functionality that uses symmetric encryption to protect URL parameters, but exposes an encryption oracle that allows attacke
- 8.1 High severity
DAP-2695: Improper Verification of Cryptographic Signature
A weakness has been identified in D-Link DAP-2695 2.00RC13. The affected element is the function sub_40C6B8 of the component Firmware Update Handler. Executing manipulation can lead to improper verification of cryptographic signature. The attack can be launche
- 8.0 High severity
rancher: Insufficient Verification of Data Authenticity
A vulnerability has been identified within Rancher Manager whereby the SAML authentication from the Rancher CLI tool is vulnerable to phishing attacks. The custom authentication protocol for SAML-based providers can be abused to steal Rancher’s authentication
- 9.1 Critical severity
Termix: Insufficient Verification of Data Authenticity
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The official Docker image for Termix versions 1.5.0 and below, due to being configured with an Nginx reverse proxy, causes the backend to retrieve the
- 9.4 Critical severity
formbricks: Improper Authentication
Formbricks is an open source qualtrics alternative. Prior to version 4.0.1, Formbricks is missing JWT signature verification. This vulnerability stems from a token validation routine that only decodes JWTs (jwt.decode) without verifying their signatures. Both
- 7.5 High severity
authlib: Insufficient Verification of Data Authenticity
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker can
- 7.2 High severity
AX1800: Insufficient Verification of Data Authenticity
A vulnerability was determined in Belkin AX1800 1.1.00.016. Affected by this vulnerability is an unknown functionality of the component Firmware Update Handler. This manipulation causes insufficient verification of data authenticity. The attack can be initiate
- 8.1 High severity
DIR-619L: Insufficient Verification of Data Authenticity
A vulnerability was determined in D-Link DIR-619L 6.02CN02. Affected is the function FirmwareUpgrade of the component boa. The manipulation leads to insufficient verification of data authenticity. It is possible to launch the attack remotely. The complexity of
- 8.1 High severity
ceph: Insufficient Verification of Data Authenticity
Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provi
- 8.4 High severity
Hybrid Data Pipeline: Insufficient Verification of Data Authenticity
In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header. Since XFF is a client-controlled header, it could be spoofed, allowing unauthorized access if the spoofed IP matched a whitelist
- 9.8 Critical severity
Firefox: Insufficient Verification of Data Authenticity
Thunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
- 7.5 High severity
Recursor: Insufficient Verification of Data Authenticity
An attacker spoofing answers to ECS enabled requests sent out by the Recursor has a chance of success higher than non-ECS enabled queries. The updated version include various mitigations against spoofing attempts of ECS enabled queries by chaining ECS enabled
- 7.8 High severity
Control Center: Insufficient Verification of Data Authenticity
A vulnerability classified as problematic was found in Eluktronics Control Center 5.23.51.41. Affected by this vulnerability is an unknown functionality of the component REG File Handler. The manipulation leads to insufficient verification of data authenticity
- 7.5 High severity
javascript: Insufficient Verification of Data Authenticity
Clerk helps developers build user management. Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events. The issue was resolved in @clerk/backend 2.4.0.
- 8.8 High severity
Internet Security Premium: Improper Validation of Integrity Check Value
A vulnerability classified as critical was found in Comodo Internet Security Premium 12.3.4.8162. This vulnerability affects unknown code of the file cis_update_x64.xml of the component Manifest File Handler. The manipulation leads to improper validation of in
- 8.8 High severity
Firefox: Insufficient Verification of Data Authenticity
The executable file warning did not warn users before opening files with the `terminal` extension. *This bug only affects Firefox for macOS. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbir
- 9.8 Critical severity
SICK Field Analytics: Insufficient Verification of Data Authenticity
The backup ZIPs are not signed by the application, leading to the possibility that an attacker can download a backup ZIP, modify and re-upload it. This allows the attacker to disrupt the application by configuring the services in a way that they are unable to
- 9.1 Critical severity
fabio: Insufficient Verification of Data Authenticity
Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. Prior to version 1.6.6, Fabio allows clients to remove X-Forwarded headers (except X-Forwarded-For) due to a vulnerability in how it processes hop-by-hop headers. Fabio adds HTTP
- 8.2 High severity
react-router: Insufficient Verification of Data Authenticity
React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values of the data object p
- 7.5 High severity
Zoom Apps: Insufficient Verification of Data Authenticity
Insufficient verification of data authenticity in some Zoom Workplace Apps may allow an unprivileged user to conduct a denial of service via network access.
- 8.5 High severity
server: Authentication Bypass by Spoofing
Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a re
- 9.8 Critical severity
picklescan: Insufficient Verification of Data Authenticity
picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected b
- 9.1 Critical severity
Vasion Print: Insufficient Verification of Data Authenticity
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.750 Application 20.0.1442 allows Insecure Firmware Image with Insufficient Verification of Data Authenticity V-2024-004.
- 8.5 High severity
libsignal-service-rs: Insufficient Verification of Data Authenticity
libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior to commit 82d70f6720e762898f34ae76b0894b0297d9b2f8, any contact may forge a sync message, impersonati
- 7.8 High severity
Intel(R) DSA software: Insufficient Verification of Data Authenticity
Insufficient verification of data authenticity in some Intel(R) DSA software before version 23.4.39 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.1 High severity
Fast-DDS: Insufficient Verification of Data Authenticity
eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.10, 2.10.7, 2.14.5, 3.0.2, 3.1.2, and 3.2.0, per design, PermissionsCA is not full chain validated, nor is the
- 8.6 High severity
Janto: Insufficient Verification of Data Authenticity
Insufficient data authenticity verification vulnerability in Janto, versions prior to r12. This allows an unauthenticated attacker to modify the content of emails sent to reset the password. To exploit the vulnerability, the attacker must create a POST request
- 7.2 High severity
MBD-X12DPG-OA6: Insufficient Verification of Data Authenticity
There is a vulnerability in the BMC firmware image authentication design at Supermicro MBD-X12DPG-OA6 . An attacker can modify the firmware to bypass BMC inspection and bypass the signature verification process