CWEweakness
CWE-1023 Incomplete Comparison with Missing Factors
- Abstraction
- Class
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.
Common consequences
• Integrity, Access Control: Alter Execution Logic, Bypass Protection Mechanism — An incomplete comparison can lead to resultant weaknesses, e.g., by operating on the wrong object or making a security decision without considering a required factor.
Detection methods
• Manual Static Analysis: Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.
Observed examples
• CVE-2005-2782: PHP remote file inclusion in web application that filters "http" and "https" URLs, but not "ftp".
• CVE-2014-6394: Product does not prevent access to restricted directories due to partial string comparison with a public directory
Related
Observed example · CVE (2)
- CVE-2014-6394 visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which… vulnerability
- CVE-2005-2782 PHP remote file inclusion vulnerability in al_initialize.php for AutoLinks Pro 2.1 allows remote attackers to execute arbitrary PHP code… vulnerability
Child of · CWE (1)
- CWE-697 Incorrect Comparison weakness
Referenced by CVE · weakness (21)
- CVE-2026-91768 The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients… vulnerability
- CVE-2026-85491 Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a… vulnerability
- CVE-2026-92611 In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops at the first wildcard… vulnerability
- CVE-2026-91836 A flaw has been found in OpenClaw ClawScan up to 0.1.6. vulnerability
- CVE-2026-54181 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build… vulnerability
- CVE-2026-81376 Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a… vulnerability
- CVE-2026-14199 Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. vulnerability
- CVE-2026-54713 CakePHP Queue is a queue-interop compatible queueing library. vulnerability
- CVE-2026-24255 NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by… vulnerability
- CVE-2026-48761 Symfony is a PHP framework for web and console applications and a set of reusable PHP components. vulnerability
- CVE-2026-53859 OpenClaw before 2026.5.26 contains a hostname validation vulnerability allowing attackers to bypass blocklist comparisons using… vulnerability
- CVE-2026-53839 OpenClaw before 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching hostname prefixes… vulnerability
- CVE-2026-7473 On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups,… vulnerability
- CVE-2026-48587 An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. vulnerability
- CVE-2026-4748 A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the… vulnerability
- CVE-2026-4599 Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the… vulnerability
- CVE-2025-62000 BullWall Ransomware Containment may not always detect an encrypted file. vulnerability
- CVE-2025-55333 Incomplete comparison with missing factors in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a… vulnerability
- CVE-2025-46722 vLLM is an inference and serving engine for large language models (LLMs). vulnerability
- CVE-2024-5528 An issue was discovered in GitLab CE/EE affecting all versions prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1… vulnerability
- CVE-2021-23146 An Incomplete Comparison with Missing Factors vulnerability in the Gallagher Controller allows an attacker to bypass PIV verification. vulnerability