Common Weakness Enumeration

CWE-636

Allowed-with-Review

Not Failing Securely ('Failing Open')

Abstraction: Class · Status: Draft

API response cwe.mitre.org

When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.

73 vulnerabilities reference this CWE, most recent first.

GHSA-GX29-8G9G-89W4

Vulnerability from github – Published: 2024-05-02 18:30 – Updated: 2024-05-02 18:30
VLAI
Details

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'fea_encrypt' function in all versions up to, and including, 3.19.4. This makes it possible for unauthenticated attackers to manipulate the user processing forms, which can be used to add and edit administrator user for privilege escalation, or to automatically log in users for authentication bypass, or manipulate the post processing form that can be used to inject arbitrary web scripts. This can only be exploited if the 'openssl' php extension is not loaded on the server.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-3729"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-636",
      "CWE-754"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-02T17:15:30Z",
    "severity": "CRITICAL"
  },
  "details": "The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling  on the \u0027fea_encrypt\u0027 function in all versions up to, and including, 3.19.4. This makes it possible for unauthenticated attackers to manipulate the user processing forms, which can be used to add and edit administrator user for privilege escalation, or to automatically log in users for authentication bypass, or manipulate the post processing form that can be used to inject arbitrary web scripts. This can only be exploited if the \u0027openssl\u0027 php extension is not loaded on the server.",
  "id": "GHSA-gx29-8g9g-89w4",
  "modified": "2024-05-02T18:30:55Z",
  "published": "2024-05-02T18:30:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3729"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.18.15/main/helpers.php#L617"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3073379/acf-frontend-form-element#file4"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a2d22c5d-5ef5-4920-a1b5-e8284394c7e8?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-GX38-8H33-PMXR

Vulnerability from github – Published: 2026-04-14 20:00 – Updated: 2026-04-24 20:35
VLAI
Summary
free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors
Details

Summary

A fail-open request handling flaw in the UDR service causes the /nudr-dr/v2/policy-data/subs-to-notify/{subsId} PUT handler to continue processing requests even after request body retrieval or deserialization errors.

This may allow unintended modification of existing Policy Data notification subscriptions with invalid, empty, or partially processed input, depending on downstream processor behavior.

Details

The endpoint PUT /nudr-dr/v2/policy-data/subs-to-notify/{subsId} is intended to update an existing Policy Data notification subscription only after the HTTP request body has been successfully read and parsed into a valid PolicyDataSubscription object. [file:93]

In the free5GC UDR implementation, the function HandlePolicyDataSubsToNotifySubsIdPut inNFs/udr/internal/sbi/api_datarepository.go does not terminate execution after input-processing failures. [file:93]

The request flow is:

  1. The handler calls c.GetRawData() to read the HTTP request body. [file:93]
  2. If GetRawData() fails, the handler sends an HTTP 500 error response, but does not return. [file:93]
  3. The handler then calls openapi.Deserialize(policyDataSubscription, reqBody, "application/json"). [file:93]
  4. If deserialization fails, the handler sends an HTTP 400 error response, but again does not return. [file:93]
  5. Execution continues and the handler still invokes s.Processor().PolicyDataSubsToNotifySubsIdPutProcedure(c, subsId, policyDataSubscription). [file:93]

As a result, the endpoint operates in a fail-open manner: request processing may continue after fatal input validation or body handling errors, instead of being safely aborted. [file:93]

The issue is compounded by the handler's deserialization call, which passes policyDataSubscription directly to openapi.Deserialize(...) instead of passing a pointer to the destination object. This inconsistent usage further increases the risk that request processing continues with an empty, partially initialized, or otherwise unintended subscription object. [file:93]

This differs from safer handlers in the same file, which use a helper pattern that explicitly returns on body read or deserialization failure before calling the corresponding processor routine. [file:93]

Security Impact

This issue affects a write-capable API that updates Policy Data notification subscriptions identified by subsId. [file:93]
Because execution continues after body read or parsing failure, the processor may receive an uninitialized, partially initialized, or otherwise unintended PolicyDataSubscription object for persistence. [file:93]

The exact runtime impact depends on downstream processor behavior and storage validation. [file:93]
At minimum, this is a security-relevant robustness flaw that can lead to inconsistent request handling or unintended modification attempts; under certain runtime conditions it may allow updates that should not be processed after an input error. [file:93]

Reproduction Status

The code path has been statically confirmed. [file:93] A complete runtime proof of unintended subscription modification after GetRawData() or deserialization failure has not yet been established. [file:93]

Patch

The handler should immediately terminate after sending an error response for body read or deserialization failure. [file:93]

A minimal fix is to add missing return statements in HandlePolicyDataSubsToNotifySubsIdPut and pass a pointer to the destination object during deserialization: [file:93]

reqBody, err := c.GetRawData()
if err != nil {
    logger.DataRepoLog.Errorf("Get Request Body error: %+v", err)
    pd := openapi.ProblemDetailsSystemFailure(err.Error())
    c.Set(sbi.IN_PB_DETAILS_CTX_STR, pd.Cause)
    c.JSON(http.StatusInternalServerError, pd)
    return
}

err = openapi.Deserialize(&policyDataSubscription, reqBody, "application/json")
if err != nil {
    logger.DataRepoLog.Errorf("Deserialize Request Body error: %+v", err)
    pd := util.ProblemDetailsMalformedReqSyntax(err.Error())
    c.Set(sbi.IN_PB_DETAILS_CTX_STR, pd.Cause)
    c.JSON(http.StatusBadRequest, pd)
    return
}
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/free5gc/udr"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.4.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40249"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-636",
      "CWE-754"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-14T20:00:59Z",
    "nvd_published_at": "2026-04-16T22:16:38Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nA fail-open request handling flaw in the UDR service causes the `/nudr-dr/v2/policy-data/subs-to-notify/{subsId}` PUT handler to continue processing requests even after request body retrieval or deserialization errors.\n\nThis may allow unintended modification of existing Policy Data notification subscriptions with invalid, empty, or partially processed input, depending on downstream processor behavior.\n\n### Details\nThe endpoint `PUT /nudr-dr/v2/policy-data/subs-to-notify/{subsId}` is intended to update an existing Policy Data notification subscription only after the HTTP request body has been successfully read and parsed into a valid `PolicyDataSubscription` object. [file:93]\n\nIn the free5GC UDR implementation, the function `HandlePolicyDataSubsToNotifySubsIdPut` in`NFs/udr/internal/sbi/api_datarepository.go` does not terminate execution after input-processing failures. [file:93]\n\nThe request flow is:\n\n1. The handler calls `c.GetRawData()` to read the HTTP request body. [file:93]\n2. If `GetRawData()` fails, the handler sends an HTTP 500 error response, but **does not return**. [file:93]\n3. The handler then calls `openapi.Deserialize(policyDataSubscription, reqBody, \"application/json\")`. [file:93]\n4. If deserialization fails, the handler sends an HTTP 400 error response, but again **does not return**. [file:93]\n5. Execution continues and the handler still invokes `s.Processor().PolicyDataSubsToNotifySubsIdPutProcedure(c, subsId, policyDataSubscription)`. [file:93]\n\nAs a result, the endpoint operates in a fail-open manner: request processing may continue after fatal input validation or body handling errors, instead of being safely aborted. [file:93]\n\nThe issue is compounded by the handler\u0027s deserialization call, which passes `policyDataSubscription` directly to `openapi.Deserialize(...)` instead of passing a pointer to the destination object. This inconsistent usage further increases the risk that request processing continues with an empty, partially initialized, or otherwise unintended subscription object. [file:93]\n\nThis differs from safer handlers in the same file, which use a helper pattern that explicitly returns on body read or deserialization failure before calling the corresponding processor routine. [file:93]\n\n### Security Impact\nThis issue affects a write-capable API that updates Policy Data notification subscriptions identified by `subsId`. [file:93]  \nBecause execution continues after body read or parsing failure, the processor may receive an uninitialized, partially initialized, or otherwise unintended `PolicyDataSubscription` object for persistence. [file:93]\n\nThe exact runtime impact depends on downstream processor behavior and storage validation. [file:93]  \nAt minimum, this is a security-relevant robustness flaw that can lead to inconsistent request handling or unintended modification attempts; under certain runtime conditions it may allow updates that should not be processed after an input error. [file:93]\n\n### Reproduction Status\nThe code path has been statically confirmed. [file:93]  A complete runtime proof of unintended subscription modification after\n`GetRawData()` or deserialization failure has not yet been established. [file:93]\n\n### Patch\nThe handler should immediately terminate after sending an error response for body read or deserialization failure. [file:93]\n\nA minimal fix is to add missing `return` statements in `HandlePolicyDataSubsToNotifySubsIdPut` and pass a pointer to the destination\nobject during deserialization: [file:93]\n\n```go\nreqBody, err := c.GetRawData()\nif err != nil {\n    logger.DataRepoLog.Errorf(\"Get Request Body error: %+v\", err)\n    pd := openapi.ProblemDetailsSystemFailure(err.Error())\n    c.Set(sbi.IN_PB_DETAILS_CTX_STR, pd.Cause)\n    c.JSON(http.StatusInternalServerError, pd)\n    return\n}\n\nerr = openapi.Deserialize(\u0026policyDataSubscription, reqBody, \"application/json\")\nif err != nil {\n    logger.DataRepoLog.Errorf(\"Deserialize Request Body error: %+v\", err)\n    pd := util.ProblemDetailsMalformedReqSyntax(err.Error())\n    c.Set(sbi.IN_PB_DETAILS_CTX_STR, pd.Cause)\n    c.JSON(http.StatusBadRequest, pd)\n    return\n}\n```",
  "id": "GHSA-gx38-8h33-pmxr",
  "modified": "2026-04-24T20:35:11Z",
  "published": "2026-04-14T20:00:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-gx38-8h33-pmxr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40249"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/free5gc/udr"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors"
}

GHSA-HC4W-HM59-9W88

Vulnerability from github – Published: 2026-06-16 21:31 – Updated: 2026-06-18 20:42
VLAI
Summary
Duplicate Advisory: Empty-scope device re-pairing could confuse caller scope containment
Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-8mg9-j9cf-54cj. This link is maintained to preserve external references.

Original Description

OpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing that allows authenticated operators to restore broader scopes than intended by submitting empty-scope re-pairing requests. Attackers can exploit this by sending re-pairing requests with empty scope sets to skip containment guards and retain unauthorized device access.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
2.3 (Low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2026.4.24"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-636"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-18T20:42:01Z",
    "nvd_published_at": "2026-06-16T19:17:02Z",
    "severity": "LOW"
  },
  "details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-8mg9-j9cf-54cj. This link is maintained to preserve external references.\n\n## Original Description\nOpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing that allows authenticated operators to restore broader scopes than intended by submitting empty-scope re-pairing requests. Attackers can exploit this by sending re-pairing requests with empty scope sets to skip containment guards and retain unauthorized device access.",
  "id": "GHSA-hc4w-hm59-9w88",
  "modified": "2026-06-18T20:42:01Z",
  "published": "2026-06-16T21:31:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-8mg9-j9cf-54cj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53852"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/openclaw-scope-bypass-via-empty-scope-device-re-pairing"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Duplicate Advisory: Empty-scope device re-pairing could confuse caller scope containment",
  "withdrawn": "2026-06-18T20:42:01Z"
}

GHSA-HM7R-C7QW-GHP6

Vulnerability from github – Published: 2026-04-03 22:01 – Updated: 2026-04-06 23:41
VLAI
Summary
fast-jwt accepts unknown `crit` header extensions (RFC 7515 violation)
Details

Summary

fast-jwt does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that fast-jwt does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.

RFC Requirement

RFC 7515 §4.1.11:

If any of the listed extension Header Parameters are not understood and supported by the recipient, then the JWS is invalid.

Proof of Concept

const { createSigner, createVerifier } = require("fast-jwt"); // v3.3.3

const signer = createSigner({ key: "secret", algorithm: "HS256" });
const token = signer({
  sub: "attacker",
  role: "admin",
  header: { crit: ["x-custom-policy"], "x-custom-policy": "require-mfa" },
});

// Should REJECT — x-custom-policy is not understood
const verifier = createVerifier({ key: "secret", algorithms: ["HS256"] });
try {
  const result = verifier(token);
  console.log("ACCEPTED:", result);
  // Output: ACCEPTED: { sub: 'attacker', role: 'admin' }
} catch (e) {
  console.log("REJECTED:", e.message);
}

Expected: Error — unsupported critical extension Actual: Token accepted.

Comparison

// jose (panva) v4+ — correctly rejects
const jose = require("jose");
await jose.jwtVerify(token, new TextEncoder().encode("secret"));
// throws: Extension Header Parameter "x-custom-policy" is not recognized

Impact

  • Split-brain verification in mixed-library environments
  • Security policy bypass when crit carries enforcement semantics
  • Token binding bypass (RFC 7800 cnf confirmation)
  • See CVE-2025-59420 for full impact analysis

Suggested Fix

In src/verifier.js, add crit validation after header decoding:

const SUPPORTED_CRIT = new Set(["b64"]);

function validateCrit(header) {
  if (!header.crit) return;
  if (!Array.isArray(header.crit) || header.crit.length === 0)
    throw new Error("crit must be a non-empty array");
  for (const ext of header.crit) {
    if (!SUPPORTED_CRIT.has(ext))
      throw new Error(`Unsupported critical extension: ${ext}`);
    if (!(ext in header))
      throw new Error(`Critical extension ${ext} not present in header`);
  }
}
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "fast-jwt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "6.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-35042"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-345",
      "CWE-636"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-03T22:01:25Z",
    "nvd_published_at": "2026-04-06T17:17:13Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\n`fast-jwt` does not validate the `crit` (Critical) Header Parameter defined in RFC 7515 \u00a74.1.11. When a JWS token contains a `crit` array listing extensions that `fast-jwt` does not understand, the library accepts the token instead of rejecting it. This violates the **MUST** requirement in the RFC.\n\n---\n\n## RFC Requirement\n\nRFC 7515 \u00a74.1.11:\n\n\u003e If any of the listed extension Header Parameters are **not understood\n\u003e and supported** by the recipient, then the **JWS is invalid**.\n\n---\n\n## Proof of Concept\n\n```javascript\nconst { createSigner, createVerifier } = require(\"fast-jwt\"); // v3.3.3\n\nconst signer = createSigner({ key: \"secret\", algorithm: \"HS256\" });\nconst token = signer({\n  sub: \"attacker\",\n  role: \"admin\",\n  header: { crit: [\"x-custom-policy\"], \"x-custom-policy\": \"require-mfa\" },\n});\n\n// Should REJECT \u2014 x-custom-policy is not understood\nconst verifier = createVerifier({ key: \"secret\", algorithms: [\"HS256\"] });\ntry {\n  const result = verifier(token);\n  console.log(\"ACCEPTED:\", result);\n  // Output: ACCEPTED: { sub: \u0027attacker\u0027, role: \u0027admin\u0027 }\n} catch (e) {\n  console.log(\"REJECTED:\", e.message);\n}\n```\n\n**Expected:** Error \u2014 unsupported critical extension\n**Actual:** Token accepted.\n\n### Comparison\n\n```javascript\n// jose (panva) v4+ \u2014 correctly rejects\nconst jose = require(\"jose\");\nawait jose.jwtVerify(token, new TextEncoder().encode(\"secret\"));\n// throws: Extension Header Parameter \"x-custom-policy\" is not recognized\n```\n\n---\n\n## Impact\n\n- **Split-brain verification** in mixed-library environments\n- **Security policy bypass** when `crit` carries enforcement semantics\n- **Token binding bypass** (RFC 7800 `cnf` confirmation)\n- See CVE-2025-59420 for full impact analysis\n\n---\n\n## Suggested Fix\n\nIn `src/verifier.js`, add crit validation after header decoding:\n\n```javascript\nconst SUPPORTED_CRIT = new Set([\"b64\"]);\n\nfunction validateCrit(header) {\n  if (!header.crit) return;\n  if (!Array.isArray(header.crit) || header.crit.length === 0)\n    throw new Error(\"crit must be a non-empty array\");\n  for (const ext of header.crit) {\n    if (!SUPPORTED_CRIT.has(ext))\n      throw new Error(`Unsupported critical extension: ${ext}`);\n    if (!(ext in header))\n      throw new Error(`Critical extension ${ext} not present in header`);\n  }\n}\n```",
  "id": "GHSA-hm7r-c7qw-ghp6",
  "modified": "2026-04-06T23:41:50Z",
  "published": "2026-04-03T22:01:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nearform/fast-jwt/security/advisories/GHSA-hm7r-c7qw-ghp6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35042"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-9ggr-2464-2j32"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nearform/fast-jwt"
    },
    {
      "type": "WEB",
      "url": "https://www.rfc-editor.org/rfc/rfc7515.html#section-4.1.11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "fast-jwt accepts unknown `crit` header extensions (RFC 7515 violation)"
}

GHSA-J2RP-GMQV-FRHV

Vulnerability from github – Published: 2024-04-04 18:30 – Updated: 2024-09-26 16:45
VLAI
Summary
HashiCorpVault does not correctly validate OCSP responses
Details

Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. Fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.

Severity
6.4 (Medium)
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/hashicorp/vault"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.16.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-2660"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-636",
      "CWE-703"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-04T22:10:49Z",
    "nvd_published_at": "2024-04-04T18:15:14Z",
    "severity": "MODERATE"
  },
  "details": "Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. Fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.",
  "id": "GHSA-j2rp-gmqv-frhv",
  "modified": "2024-09-26T16:45:51Z",
  "published": "2024-04-04T18:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2660"
    },
    {
      "type": "WEB",
      "url": "https://discuss.hashicorp.com/t/hcsec-2024-07-vault-tls-cert-auth-method-did-not-correctly-validate-ocsp-responses/64573"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/hashicorp/vault"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20240524-0007"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "HashiCorpVault does not correctly validate OCSP responses"
}

GHSA-JGQ2-QV8V-5CMJ

Vulnerability from github – Published: 2026-04-14 20:00 – Updated: 2026-04-24 20:36
VLAI
Summary
free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions
Details

Summary

An improper path validation vulnerability in the UDR service allows any unauthenticated attacker with access to the 5G Service Based Interface (SBI) to create or overwrite Traffic Influence Subscriptions by supplying an arbitrary value in place of the expected subs-to-notify path segment.

Details

The endpoint PUT /nudr-dr/v2/application-data/influenceData/{influenceId}/{subscriptionId} is intended to only operate on Traffic Influence Subscription resources when influenceId is exactly subs-to-notify.

In the free5GC UDR implementation, the path validation is present but ineffective because the handler does not return after sending the HTTP 404 response. The request handling flow is:

  1. The function HandleApplicationDataInfluenceDataSubsToNotifySubscriptionIdPutin ./free5gc_4-2-1/free5gc/NFs/udr/internal/sbi/api_datarepository.gochecks whether influenceId != "subs-to-notify".
  2. If the value is different, it calls c.String(http.StatusNotFound, "404 page not found"), but it does not return afterwards.
  3. Execution continues, the request body is still parsed, and the handler calls s.Processor().ApplicationDataInfluenceDataSubsToNotifySubscriptionIdPutProcedure(c, subscriptionId, &trafficInfluSub).
  4. The processor creates or updates the subscription identified by subscriptionId even though the path is invalid and the request should have been rejected.

As a result, an attacker can send a request to an invalid path, receive an apparent 404 page not found response, and still successfully create or modify the target subscription in the UDR.

The missing return after sending the 404 response in api_datarepository.go is the root cause of this vulnerability.

PoC

No authentication is required. The attacker can choose an arbitrary subscriptionId.

curl -v -X PUT "http://<udr-host>/nudr-dr/v2/application-data/influenceData/WRONGID/nuovoid" \
  -H "Content-Type: application/json" \
  -d '{
    "notificationUri":"http://evil.com",
    "dnns":["internet"],
    "supis":["imsi-999999999999999"]
  }'

Response:

HTTP/1.1 404 Not Found
404 page not found{"dnns":["internet"],"supis":["imsi-999999999999999"],"notificationUri":"http://evil.com"}

Now verify that the object was actually written:

curl -v "http://<udr-host>/nudr-dr/v2/application-data/influenceData/subs-to-notify/nuovoid"

Response:

{"dnns":["internet"],"supis":["imsi-999999999999999"],"notificationUri":"http://evil.com"}

Impact

This is an unauthenticated unauthorized write vulnerability. Any attacker with network access to the SBI can create or overwrite Traffic Influence Subscriptions by choosing an arbitrary subscriptionId, even when using an invalid path that should have been rejected.

This allows injection of attacker-controlled subscription data, including arbitrary SUPIs and attacker-controlled notificationUri values. Depending on deployment behavior, this may enable malicious redirection of policy-related notifications, corruption of subscription state, or disruption of legitimate network policy logic.

The attack is also difficult to detect because the API returns a misleading 404 Not Found response even when the write operation is actually performed.

Impacted deployments: any free5GC instance where the SBI is reachable by untrusted parties (e.g., misconfigured network segmentation, rogue NF, or compromised internal host).

Patch

The vulnerability has been confirmed patched by adding the missing return statement in NFs/udr/internal/sbi/api_datarepository.go, function HandleApplicationDataInfluenceDataSubsToNotifySubscriptionIdPut:

if influenceId != "subs-to-notify" {
    c.String(http.StatusNotFound, "404 page not found")
    return
}

With the patch applied, requests using an invalid influenceId now correctly return HTTP 404 and do not create or modify subscription data.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/free5gc/udr"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.4.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40248"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-636"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-14T20:00:45Z",
    "nvd_published_at": "2026-04-16T22:16:38Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nAn improper path validation vulnerability in the UDR service allows any unauthenticated attacker with access to the 5G Service Based Interface (SBI) to create or overwrite Traffic Influence Subscriptions by supplying an arbitrary value in place of the expected `subs-to-notify` path segment.\n\n### Details\nThe endpoint `PUT /nudr-dr/v2/application-data/influenceData/{influenceId}/{subscriptionId}` is intended to only operate on Traffic Influence Subscription resources when `influenceId` is exactly `subs-to-notify`.\n\nIn the free5GC UDR implementation, the path validation is present but ineffective because the handler does not return after sending the HTTP 404 response. The request handling flow is:\n\n1. The function `HandleApplicationDataInfluenceDataSubsToNotifySubscriptionIdPut`in `./free5gc_4-2-1/free5gc/NFs/udr/internal/sbi/api_datarepository.go`checks whether `influenceId != \"subs-to-notify\"`.\n2. If the value is different, it calls `c.String(http.StatusNotFound, \"404 page not found\")`, **but it does not return afterwards**.\n3. Execution continues, the request body is still parsed, and the handler calls `s.Processor().ApplicationDataInfluenceDataSubsToNotifySubscriptionIdPutProcedure(c, subscriptionId, \u0026trafficInfluSub)`.\n4. The processor creates or updates the subscription identified by `subscriptionId` even though the path is invalid and the request should have been rejected.\n\nAs a result, an attacker can send a request to an invalid path, receive an apparent `404 page not found` response, and still successfully create or modify the target subscription in the UDR.\n\nThe missing `return` after sending the 404 response in `api_datarepository.go` is the root cause of this vulnerability.\n\n### PoC\nNo authentication is required. The attacker can choose an arbitrary `subscriptionId`.\n\n```bash\ncurl -v -X PUT \"http://\u003cudr-host\u003e/nudr-dr/v2/application-data/influenceData/WRONGID/nuovoid\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\n    \"notificationUri\":\"http://evil.com\",\n    \"dnns\":[\"internet\"],\n    \"supis\":[\"imsi-999999999999999\"]\n  }\u0027\n```\n\nResponse:\n```\nHTTP/1.1 404 Not Found\n404 page not found{\"dnns\":[\"internet\"],\"supis\":[\"imsi-999999999999999\"],\"notificationUri\":\"http://evil.com\"}\n```\nNow verify that the object was actually written:\n\n```bash\ncurl -v \"http://\u003cudr-host\u003e/nudr-dr/v2/application-data/influenceData/subs-to-notify/nuovoid\"\n```\nResponse:\n```json\n{\"dnns\":[\"internet\"],\"supis\":[\"imsi-999999999999999\"],\"notificationUri\":\"http://evil.com\"}\n```\n### Impact\nThis is an unauthenticated unauthorized write vulnerability. Any attacker with network access to the SBI can create or overwrite Traffic Influence Subscriptions by choosing an arbitrary subscriptionId, even when using an invalid path that should have been rejected.\n\nThis allows injection of attacker-controlled subscription data, including arbitrary SUPIs and attacker-controlled notificationUri values. Depending on deployment behavior, this may enable malicious redirection of policy-related notifications, corruption of subscription state, or disruption of legitimate network policy logic.\n\nThe attack is also difficult to detect because the API returns a misleading 404 Not Found response even when the write operation is actually performed.\n\nImpacted deployments: any free5GC instance where the SBI is reachable by untrusted parties (e.g., misconfigured network segmentation, rogue NF, or compromised internal host).\n\n### Patch\nThe vulnerability has been confirmed patched by adding the missing return statement in NFs/udr/internal/sbi/api_datarepository.go,\nfunction HandleApplicationDataInfluenceDataSubsToNotifySubscriptionIdPut:\n\n```go\nif influenceId != \"subs-to-notify\" {\n    c.String(http.StatusNotFound, \"404 page not found\")\n    return\n}\n```\nWith the patch applied, requests using an invalid influenceId now correctly return HTTP 404 and do not create or modify subscription data.",
  "id": "GHSA-jgq2-qv8v-5cmj",
  "modified": "2026-04-24T20:36:00Z",
  "published": "2026-04-14T20:00:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-jgq2-qv8v-5cmj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40248"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/free5gc/udr"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions"
}

GHSA-JGQ2-VQ69-GR6H

Vulnerability from github – Published: 2026-04-17 21:31 – Updated: 2026-04-24 20:49
VLAI
Summary
OpenViking: Unauthenticated remote bot control via OpenAPI HTTP routes
Details

OpenViking prior to commit c7bb167 contains an authentication bypass vulnerability in the VikingBot OpenAPI HTTP route surface where the authentication check fails open when the api_key configuration value is unset or empty. Remote attackers with network access to the exposed service can invoke privileged bot-control functionality without providing a valid X-API-Key header, including submitting attacker-controlled prompts, creating or using bot sessions, and accessing downstream tools, integrations, secrets, or data accessible to the bot.

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
9.1 (Critical)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "openviking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40525"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-636"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-24T20:49:51Z",
    "nvd_published_at": "2026-04-17T19:16:39Z",
    "severity": "CRITICAL"
  },
  "details": "OpenViking prior to commit\u00a0c7bb167 contains an authentication bypass vulnerability in the VikingBot OpenAPI HTTP route surface where the authentication check fails open when the api_key configuration value is unset or empty. Remote attackers with network access to the exposed service can invoke privileged bot-control functionality without providing a valid X-API-Key header, including submitting attacker-controlled prompts, creating or using bot sessions, and accessing downstream tools, integrations, secrets, or data accessible to the bot.",
  "id": "GHSA-jgq2-vq69-gr6h",
  "modified": "2026-04-24T20:49:51Z",
  "published": "2026-04-17T21:31:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40525"
    },
    {
      "type": "WEB",
      "url": "https://github.com/volcengine/OpenViking/pull/1447"
    },
    {
      "type": "WEB",
      "url": "https://github.com/volcengine/OpenViking/commit/c7bb1676f4d037609f041bf39e4e2bd52e8f9820"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/volcengine/OpenViking"
    },
    {
      "type": "WEB",
      "url": "https://github.com/volcengine/OpenViking/releases/tag/v0.3.9"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/openviking-authentication-bypass-via-vikingbot-openapi"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenViking: Unauthenticated remote bot control via OpenAPI HTTP routes"
}

GHSA-JJQG-FQRM-G2VJ

Vulnerability from github – Published: 2023-02-14 18:30 – Updated: 2023-02-23 18:31
VLAI
Details

In Splunk Add-on Builder (AoB) versions below 4.1.2 and the Splunk CloudConnect SDK versions below 3.1.3, requests to third-party APIs through the REST API Modular Input incorrectly revert to using HTTP to connect after a failure to connect over HTTPS occurs. The vulnerability affects AoB and apps that AoB generates when using the REST API Modular Input functionality through its user interface. The vulnerability also potentially affects third-party apps and add-ons that call the cloudconnectlib.splunktacollectorlib.cloud_connect_mod_input Python class directly.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-22943"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295",
      "CWE-636"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-02-14T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In Splunk Add-on Builder (AoB) versions below 4.1.2 and the Splunk CloudConnect SDK versions below 3.1.3, requests to third-party APIs through the REST API Modular Input incorrectly revert to using HTTP to connect after a failure to connect over HTTPS occurs. The vulnerability affects AoB and apps that AoB generates when using the REST API Modular Input functionality through its user interface. The vulnerability also potentially affects third-party apps and add-ons that call the *cloudconnectlib.splunktacollectorlib.cloud_connect_mod_input* Python class directly.",
  "id": "GHSA-jjqg-fqrm-g2vj",
  "modified": "2023-02-23T18:31:05Z",
  "published": "2023-02-14T18:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22943"
    },
    {
      "type": "WEB",
      "url": "https://advisory.splunk.com/advisories/SVD-2023-0213"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MV66-48P3-PFM6

Vulnerability from github – Published: 2026-05-29 15:30 – Updated: 2026-05-29 15:30
VLAI
Details

Incorrect behavior order in the Infotainment / Digital Round display of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass the PIN entry screen. The Infotainment uses presence of Wireless Control Module (WCM) traffic during its boot window as a proxy for whether an immobilizer is fitted; if no WCM messages are observed, it skips the PIN entry screen and shows the normal user interface. An attacker who silences the WCM during the boot window — for example via a separately tracked CAN bus-off technique — can present a fully unlocked Infotainment despite the PIN never being entered. Specific timing and protocol details have been withheld pending vendor remediation.

Severity
2.4 (Low)
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1.0 (Low)
CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-49318"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-636"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-29T14:16:32Z",
    "severity": "LOW"
  },
  "details": "Incorrect behavior order in the Infotainment / Digital Round display of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass the PIN entry screen. The Infotainment uses presence of Wireless Control Module (WCM) traffic during its boot window as a proxy for whether an immobilizer is fitted; if no WCM messages are observed, it skips the PIN entry screen and shows the normal user interface. An attacker who silences the WCM during the boot window \u2014 for example via a separately tracked CAN bus-off technique \u2014 can present a fully unlocked Infotainment despite the PIN never being entered. Specific timing and protocol details have been withheld pending vendor remediation.",
  "id": "GHSA-mv66-48p3-pfm6",
  "modified": "2026-05-29T15:30:35Z",
  "published": "2026-05-29T15:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49318"
    },
    {
      "type": "WEB",
      "url": "https://cwe.mitre.org/data/definitions/696.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-MV67-X3M9-JJ9P

Vulnerability from github – Published: 2023-08-17 18:31 – Updated: 2024-04-04 07:01
VLAI
Details

A vulnerability was reported in BIOS for ThinkPad P14s Gen 2, P15s Gen 2, T14 Gen 2, and T15 Gen 2 that could cause the system to recover to insecure settings if the BIOS becomes corrupt.

Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-4030"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-636"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-08-17T17:15:10Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability was reported in BIOS for ThinkPad P14s Gen 2, P15s Gen 2, T14 Gen 2, and T15 Gen 2 that could cause the system to recover to insecure settings if the BIOS becomes corrupt.",
  "id": "GHSA-mv67-x3m9-jj9p",
  "modified": "2024-04-04T07:01:57Z",
  "published": "2023-08-17T18:31:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4030"
    },
    {
      "type": "WEB",
      "url": "https://support.lenovo.com/us/en/product_security/LEN-134879"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design

Subdivide and allocate resources and components so that a failure in one part does not affect the entire product.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list