CWEweakness
CWE-1025 Comparison Using Wrong Factors
- Abstraction
- Class
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities.
Common consequences
• Other: Varies by Context — This can lead to incorrect results and resultant
weaknesses. For example, the code might inadvertently
compare references to objects, instead of the relevant
contents of those objects, causing two "equal" objects
to be considered unequal.
Detection methods
• Manual Static Analysis: Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.
Related
Child of · CWE (1)
- CWE-697 Incorrect Comparison weakness
Referenced by CVE · weakness (22)
- CVE-2026-114649 The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached… vulnerability
- CVE-2026-104048 A flaw was found in SSSD. vulnerability
- CVE-2026-100248 The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value of current_admin. vulnerability
- CVE-2026-14441 A logic flaw in Java cache key handling object comparison handling could lead to improper identifier resolution when processing specific… vulnerability
- CVE-2026-79677 Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of… vulnerability
- CVE-2026-93854 In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT… vulnerability
- CVE-2026-29811 CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain;… vulnerability
- CVE-2023-54390 PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null… vulnerability
- CVE-2026-78619 Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because… vulnerability
- CVE-2026-75840 ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses… vulnerability
- CVE-2025-71377 stoatchat (delta) versions before 20250210-1 (0.8.2) contain a logic error in the query messages route. vulnerability
- CVE-2026-9800 A flaw was found in Keycloak Policy Enforcer. vulnerability
- CVE-2026-48860 Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the… vulnerability
- CVE-2026-40880 ZEBRA is a Zcash node written entirely in Rust. vulnerability
- CVE-2026-40227 In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element. vulnerability
- CVE-2026-21691 iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color… vulnerability
- CVE-2025-32464 HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow because of mishandling… vulnerability
- CVE-2025-2887 During a target rollback, the client fails to detect the rollback for delegated targets. vulnerability
- CVE-2025-2888 During a snapshot rollback, the client incorrectly caches the timestamp metadata. vulnerability
- CVE-2025-25306 Misskey is an open source, federated social media platform. vulnerability
- CVE-2025-27839 operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic flow in offline wallet attestation… vulnerability
- CVE-2024-20342 Multiple Cisco products are affected by a vulnerability in the rate filtering feature of the Snort detection engine that could allow an… vulnerability