CWE-1259
AllowedImproper Restriction of Security Token Assignment
Abstraction: Base · Status: Incomplete
The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected.
23 vulnerabilities reference this CWE, most recent first.
GHSA-P49J-V9WC-WG57
Vulnerability from github – Published: 2026-04-21 18:27 – Updated: 2026-04-21 18:27Impact
OpenBao's namespaces provide multi-tenant separation. A tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant.
Patches
This was addressed in v2.5.3.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/openbao/openbao"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.0-20260420162526-f58111d2ca54"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-40264"
],
"database_specific": {
"cwe_ids": [
"CWE-1259"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-21T18:27:42Z",
"nvd_published_at": "2026-04-21T01:16:06Z",
"severity": "LOW"
},
"details": "### Impact\n\nOpenBao\u0027s namespaces provide multi-tenant separation. A tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant.\n\n### Patches\n\nThis was addressed in v2.5.3.",
"id": "GHSA-p49j-v9wc-wg57",
"modified": "2026-04-21T18:27:42Z",
"published": "2026-04-21T18:27:42Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openbao/openbao/security/advisories/GHSA-p49j-v9wc-wg57"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40264"
},
{
"type": "WEB",
"url": "https://github.com/openbao/openbao/pull/2934"
},
{
"type": "WEB",
"url": "https://github.com/openbao/openbao/commit/059cc5950303688335d5c8ab9af8e453795d693a"
},
{
"type": "PACKAGE",
"url": "https://github.com/openbao/openbao"
},
{
"type": "WEB",
"url": "https://github.com/openbao/openbao/releases/tag/v2.5.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenBao\u0027s Token Store Allows Cross-Namespace Renewal, Revocation"
}
GHSA-R9R6-V98F-CVCC
Vulnerability from github – Published: 2025-09-23 12:31 – Updated: 2025-09-23 12:31An information disclosure vulnerability exists in multiple WSO2 products due to improper implementation of the enrich mediator. Authenticated users may be able to view unintended business data from other mediation contexts because the internal state is not properly isolated or cleared between executions.
This vulnerability does not impact user credentials or access tokens but may lead to leakage of sensitive business information handled during message flows.
{
"affected": [],
"aliases": [
"CVE-2024-4598"
],
"database_specific": {
"cwe_ids": [
"CWE-1259"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-23T11:15:39Z",
"severity": "MODERATE"
},
"details": "An information disclosure vulnerability exists in multiple WSO2 products due to improper implementation of the enrich mediator. Authenticated users may be able to view unintended business data from other mediation contexts because the internal state is not properly isolated or cleared between executions.\n\nThis vulnerability does not impact user credentials or access tokens but may lead to leakage of sensitive business information handled during message flows.",
"id": "GHSA-r9r6-v98f-cvcc",
"modified": "2025-09-23T12:31:11Z",
"published": "2025-09-23T12:31:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4598"
},
{
"type": "WEB",
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3355"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VGH5-4JJP-4PMH
Vulnerability from github – Published: 2025-09-30 18:30 – Updated: 2025-10-01 21:31TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. A temporary password or reset token issued to one user can be used to log in as another user, due to improper validation of token-user linkage. This allows remote attackers to gain unauthorized access to any user account by exploiting the password reset mechanism. The vulnerability occurs because the reset token is not correctly bound to the requesting account and is accepted for other user emails during login, enabling privilege escalation and information disclosure.
{
"affected": [],
"aliases": [
"CVE-2025-56676"
],
"database_specific": {
"cwe_ids": [
"CWE-1259"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-30T16:15:53Z",
"severity": "MODERATE"
},
"details": "TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. A temporary password or reset token issued to one user can be used to log in as another user, due to improper validation of token-user linkage. This allows remote attackers to gain unauthorized access to any user account by exploiting the password reset mechanism. The vulnerability occurs because the reset token is not correctly bound to the requesting account and is accepted for other user emails during login, enabling privilege escalation and information disclosure.",
"id": "GHSA-vgh5-4jjp-4pmh",
"modified": "2025-10-01T21:31:20Z",
"published": "2025-09-30T18:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-56676"
},
{
"type": "WEB",
"url": "https://codecanyon.net/item/zender-android-mobile-devices-as-sms-gateway-saas-platform/26594230"
},
{
"type": "WEB",
"url": "https://darklotus.medium.com/cve-2025-56676-critical-vulnerability-in-zender-gateway-allows-account-takeover-2b5bcb50c762"
},
{
"type": "WEB",
"url": "https://previews.titansystems.ph/zender/dashboard/auth"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
- Security Token assignment review checks for design inconsistency and common weaknesses.
- Security-Token definition and programming flow is tested in both pre-silicon and post-silicon testing.
CAPEC-121: Exploit Non-Production Interfaces
An adversary exploits a sample, demonstration, test, or debug interface that is unintentionally enabled on a production system, with the goal of gleaning information or leveraging functionality that would otherwise be unavailable.
CAPEC-681: Exploitation of Improperly Controlled Hardware Security Identifiers
An adversary takes advantage of missing or incorrectly configured security identifiers (e.g., tokens), which are used for access control within a System-on-Chip (SoC), to read/write data or execute a given action.