CWEweakness
CWE-345 Insufficient Verification of Data Authenticity
- Abstraction
- Class
- Structure
- Simple
- Status
- Draft
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Common consequences
• Integrity, Other: Varies by Context, Unexpected State
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed examples
• CVE-2022-30260: Distributed Control System (DCS) does not sign firmware images and only relies on insecure checksums for integrity checks
• CVE-2022-30267: Distributed Control System (DCS) does not sign firmware images and only relies on insecure checksums for integrity checks
• CVE-2022-30272: Remote Terminal Unit (RTU) does not use signatures for firmware images and relies on insecure checksums
Related
Observed example · not in database (1)
Attack pattern · CAPEC (12)
- CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) attack pattern
- CAPEC-141 Cache Poisoning attack pattern
- CAPEC-142 DNS Cache Poisoning attack pattern
- CAPEC-148 Content Spoofing attack pattern
- CAPEC-218 Spoofing of UDDI/ebXML Messages attack pattern
- CAPEC-384 Application API Message Manipulation via Man-in-the-Middle attack pattern
- CAPEC-385 Transaction or Event Tampering via Application API Manipulation attack pattern
- CAPEC-386 Application API Navigation Remapping attack pattern
- CAPEC-387 Navigation Remapping To Propagate Malicious Content attack pattern
- CAPEC-388 Application API Button Hijacking attack pattern
- CAPEC-665 Exploitation of Thunderbolt Protection Flaws attack pattern
- CAPEC-701 Browser in the Middle (BiTM) attack pattern
Observed example · CVE (2)
- CVE-2022-30260 Emerson DeltaV Distributed Control System (DCS) has insufficient verification of firmware integrity (an inadequate checksum approach, and… vulnerability
- CVE-2022-30272 The Motorola ACE1000 RTU through 2022-05-02 mishandles firmware integrity. vulnerability
Child of · CWE (1)
- CWE-693 Protection Mechanism Failure weakness
Referenced by CAPEC · weakness (12)
- CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) attack pattern
- CAPEC-141 Cache Poisoning attack pattern
- CAPEC-142 DNS Cache Poisoning attack pattern
- CAPEC-148 Content Spoofing attack pattern
- CAPEC-218 Spoofing of UDDI/ebXML Messages attack pattern
- CAPEC-384 Application API Message Manipulation via Man-in-the-Middle attack pattern
- CAPEC-385 Transaction or Event Tampering via Application API Manipulation attack pattern
- CAPEC-386 Application API Navigation Remapping attack pattern
- CAPEC-387 Navigation Remapping To Propagate Malicious Content attack pattern
- CAPEC-388 Application API Button Hijacking attack pattern
- CAPEC-665 Exploitation of Thunderbolt Protection Flaws attack pattern
- CAPEC-701 Browser in the Middle (BiTM) attack pattern
Referenced by CVE · weakness (893)
- CVE-2026-93008 A flaw was found in dnsmasq. vulnerability
- CVE-2026-103313 The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the… vulnerability
- CVE-2026-103330 The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the… vulnerability
- CVE-2026-103402 An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart… vulnerability
- CVE-2026-110952 A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature,… vulnerability
- CVE-2026-110985 A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its… vulnerability
- CVE-2026-118377 mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to… vulnerability
- CVE-2026-103359 The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming payment notifications… vulnerability
- CVE-2026-104381 A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker… vulnerability
- CVE-2026-115408 In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8`, the ML-KEM key-pair lookup functions… vulnerability
- CVE-2026-116608 A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1. vulnerability
- CVE-2026-103300 The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely… vulnerability
- CVE-2026-115910 Python Social Auth is a social authentication and registration mechanism. vulnerability
- CVE-2026-116116 A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. vulnerability
- CVE-2026-116254 A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. vulnerability
- CVE-2026-115183 The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities… vulnerability
- CVE-2026-115933 Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. vulnerability
- CVE-2026-110510 The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using… vulnerability
- CVE-2026-115937 The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: *… vulnerability
- CVE-2026-55459 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. vulnerability
- CVE-2026-56832 PraisonAI is a multi-agent teams system. vulnerability
- CVE-2026-114612 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. vulnerability
- CVE-2026-103301 The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because… vulnerability
- CVE-2026-104641 The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the… vulnerability
- CVE-2026-104642 The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can… vulnerability
- CVE-2026-105256 The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking… vulnerability
- CVE-2026-114050 vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing… vulnerability
- CVE-2026-112939 filelock is a platform-independent file lock for Python. vulnerability
- CVE-2026-43835 A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file,… vulnerability
- CVE-2026-87414 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). vulnerability
Referenced by CWE · can also be (2)
Referenced by CWE · child of (15)
- CWE-1293 Missing Source Correlation of Multiple Independent Data weakness
- CWE-346 Origin Validation Error weakness
- CWE-347 Improper Verification of Cryptographic Signature weakness
- CWE-348 Use of Less Trusted Source weakness
- CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data weakness
- CWE-351 Insufficient Type Distinction weakness
- CWE-352 Cross-Site Request Forgery weakness
- CWE-353 Missing Support for Integrity Check weakness
- CWE-354 Improper Validation of Integrity Check Value weakness
- CWE-360 Trust of System Event Data weakness
- CWE-494 Download of Code Without Integrity Check weakness
- CWE-616 Incomplete Identification of Uploaded File Variables (PHP) weakness
- CWE-646 Reliance on File Name or Extension of Externally-Supplied File weakness
- CWE-649 Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking weakness
- CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel weakness