Reliance on Cookies without Validation and Integrity Checking
CWE-565
The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
We track 32 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.8. 1 has been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Avoid using cookie data for a security-related decision.
- Implementation: Perform thorough input validation (i.e.: server side validation) on the cookie data if you're going to use it for a security related decision.
- Architecture and Design: Add integrity checks to detect tampering.
- Architecture and Design: Protect critical cookies from replay attacks, since cross-site scripting or other attacks may allow attackers to steal a strongly-encrypted cookie that also passes integrity checks. This mitigation applies to cookies that should only be valid during a single transaction or session. By enforcing timeouts, you may limit the scope of an attack. As part of your integrity check, use an unpredictable, server-side value that is not exposed to the client.
Latest Reliance on Cookies without Validation and Integrity Checking vulnerabilities
- 7.4 High severity
zitadel: Reliance on Cookies without Validation and Integrity Checking
ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie
- 9.8 Critical severity
SureLine: Reliance on Cookies without Validation and Integrity Checking
Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random ide
- 9.3 Critical severity
Stela: Reliance on Cookies without Validation and Integrity Checking
Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” without validating its integrity. The application stores the user identifier (userId) and the status of the authentication process (validStep
- 9.1 Critical severity
Apache Airflow Keycloak provider: Reliance on Cookies without Validation and Integrity Checking
Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated coo
- 9.8 Critical severity
cat: Reliance on Cookies without Validation and Integrity Checking
CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin session
- 8.3 High severity
ash_admin: Reliance on Cookies without Validation and Integrity Checking
Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript r
- 8.1 High severity
hermes-webui: Reliance on Cookies without Validation and Integrity Checking
Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cookie() function that accepts unauthenticated profile names from the hermes_profile cookie. An authenticated attacker can forge the hermes_profile cookie value to b
- 9.1 Critical severity
Palo Alto Networks PAN-OS Authentication Bypass Exploited
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by t
- 9.8 Critical severity
rack-session: Improper Authentication
Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie decryption fails, the implementation falls back to a default decod
- 8.8 High severity
Debugger & Troubleshooter: Reliance on Cookies without Validation and Integrity Checking
The Debugger & Troubleshooter plugin for WordPress was vulnerable to Unauthenticated Privilege Escalation in versions up to and including 1.3.2. This was due to the plugin accepting the wp_debug_troubleshoot_simulate_user cookie value directly as a user ID wit
- 9.8 Critical severity
WAGO 750-8212 PFC200: Reliance on Cookies without Validation and Integrity Checking
WAGO 750-8212 PFC200 G2 2ETH RS firmware contains a privilege escalation vulnerability that allows attackers to manipulate user session cookies. Attackers can modify the cookie's 'name' and 'roles' parameters to elevate from ordinary user to administrative pri
- 9.8 Critical severity
Hy511 Firmware: Reliance on Cookies without Validation and Integrity Checking
An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1. The vulnerability stems from the device's insufficient cookie verification, allowing an attacker to directly request the configuration file address and download the core config
- 9.8 Critical severity
JAY Login & Register: Reliance on Cookies without Validation and Integrity Checking
The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authentication checking in the 'jay_login_register_process_switch_back' function with the 'jay_login_registe
- 8.1 High severity
FortiWeb: Reliance on Cookies without Validation and Integrity Checking
A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an unaut
- 9.8 Critical severity
U-Office Force: Reliance on Cookies without Validation and Integrity Checking
The U-Office Force from e-Excellence has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to use a particular API and alter cookies to log in as an administrator.
- 8.8 High severity
FlowMaster BPM Plus: Reliance on Cookies without Validation and Integrity Checking
The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular privileges can elevate their privileges to administrator by tampering with a specific cookie.
- 7.5 High severity
AuthPress: Reliance on Cookies without Validation and Integrity Checking
The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This is due to the two-factor code being stored in a cookie, which makes it possible to bypass two-factor authentication.
- 9.8 Critical severity
Elektraweb: Reliance on Cookies without Validation and Integrity Checking
Reliance on Cookies without Validation and Integrity Checking vulnerability in Talya Informatics Elektraweb allows Session Credential Falsification through Manipulation, Accessing/Intercepting/Modifying HTTP Cookies, Manipulating Opaque Client-based Data Token
- 8.8 High severity
Compact DAB Transmitter: Reliance on Cookies without Validation and Integrity Checking
The application suffers from a privilege escalation vulnerability. An attacker logged in as guest can escalate his privileges by poisoning the cookie to become administrator.
- 7.5 High severity
Compact DAB Transmitter: Reliance on Cookies without Validation and Integrity Checking
The device allows an unauthenticated attacker to bypass authentication and modify the cookie to reveal hidden pages that allows more critical operations to the transmitter.
- 9.8 Critical severity
rg-nbr700gw_firmware: Reliance on Cookies without Validation and Integrity Checking
Ruijie RG-NBR700GW 10.3(4b12) router lacks cookie verification when resetting the password, resulting in an administrator password reset vulnerability. An attacker can use this vulnerability to log in to the device and disrupt the business of the enterprise.
- 8.8 High severity
Zabbix: Reliance on Cookies without Validation and Integrity Checking
The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user.
- 8.8 High severity
fiber: Cross-Site Request Forgery
Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to una
- 8.8 High severity
Fiber is an express inspired web framework written in Go.
Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vulne
- 9.8 Critical severity
MODULYS GP (MOD3GP-SY-120K): Reliance on Cookies without Validation and Integrity Checking
Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the web app allows on the device.
- 7.2 High severity
WL-WN531AX2: Reliance on Cookies without Validation and Integrity Checking
Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker with an administrative privilege to execute OS commands with the root privilege.
- 9.8 Critical severity
Lockcell: Reliance on Cookies without Validation and Integrity Checking
Reliance on Cookies without Validation and Integrity Checking in a Security Decision vulnerability in TMT Lockcell allows Privilege Abuse, Authentication Bypass. This issue affects Lockcell: before 15.
- 7.5 High severity
Security Verify Information Queue: Reliance on Cookies without Validation and Integrity Checking
IBM Security Verify Information Queue 10.0.2 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie. IBM X-Force ID: 230811.
- 8.8 High severity
Cellinx NVT - IP PTZ Camera: Reliance on Cookies without Validation and Integrity Checking
On Cellinx Camera with guest enabled, attacker with web access can elevate privileges to administrative: "1" to "0" privileges by changing the following cookie values from "is_admin", "showConfig". Administrative Privileges which allows changing various config
- 8.1 High severity
guzzle: Reliance on Cookies without Validation and Integrity Checking
Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the Set-Cookie
- 9.1 Critical severity
Zoom Client for Meetings for Android: Reliance on Cookies without Validation and Integrity Checking
The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom domains. This issue could be used in a more sophisticated attack to send an unsuspecting users Zoom-sco
- 7.2 High severity
Mwid25-ds Firmware: Reliance on Cookies without Validation and Integrity Checking
An issue in upload.csp of FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows attackers to write files and reset the user passwords without having a valid session cookie.