CWEweakness
CWE-346 Origin Validation Error
- Abstraction
- Class
- Structure
- Simple
- Status
- Draft
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product does not properly verify that the source of data or communication is valid.
Common consequences
• Access Control, Other: Gain Privileges or Assume Identity, Varies by Context — An attacker can access any functionality that is inadvertently accessible to the source.
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed examples
• CVE-2000-1218: DNS server can accept DNS updates from hosts that it did not query, leading to cache poisoning
• CVE-2018-6074: Browser does not set Mark-of-the-Web (MotW) for a downloaded .EXE file if the name is close to the maximum path length, preventing recording of a zone identifier in the filename
• CVE-2025-0411: Zip file extraction program does not propagate Mark-of-the-Web (MotW) metadata to files that are extracted from an Internet-downloaded Zip file
• CVE-2025-46652: Zip file extraction program does not propagate Mark-of-the-Web (MotW) metadata to files that are extracted from an Internet-downloaded Zip file
• CVE-2005-0877: DNS server can accept DNS updates from hosts that it did not query, leading to cache poisoning
• CVE-2001-1452: DNS server caches glue records received from non-delegated name servers
• CVE-2005-2188: user ID obtained from untrusted source (URL)
• CVE-2003-0174: LDAP service does not verify if a particular attribute was set by the LDAP server
• CVE-1999-1549: product does not sufficiently distinguish external HTML from internal, potentially dangerous HTML, allowing bypass using special strings in the page title. Overlaps special elements.
• CVE-2003-0981: Product records the reverse DNS name of a visitor in the logs, allowing spoofing and resultant XSS.
Related
Attack pattern · CAPEC (16)
- CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) attack pattern
- CAPEC-141 Cache Poisoning attack pattern
- CAPEC-142 DNS Cache Poisoning attack pattern
- CAPEC-160 Exploit Script-Based APIs attack pattern
- CAPEC-21 Exploitation of Trusted Identifiers attack pattern
- CAPEC-384 Application API Message Manipulation via Man-in-the-Middle attack pattern
- CAPEC-385 Transaction or Event Tampering via Application API Manipulation attack pattern
- CAPEC-386 Application API Navigation Remapping attack pattern
- CAPEC-387 Navigation Remapping To Propagate Malicious Content attack pattern
- CAPEC-388 Application API Button Hijacking attack pattern
- CAPEC-510 SaaS User Request Forgery attack pattern
- CAPEC-59 Session Credential Falsification through Prediction attack pattern
- CAPEC-60 Reusing Session IDs (aka Session Replay) attack pattern
- CAPEC-75 Manipulating Writeable Configuration Files attack pattern
- CAPEC-76 Manipulating Web Input to File System Calls attack pattern
- CAPEC-89 Pharming attack pattern
Observed example · CVE (10)
- CVE-2025-46652 In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. vulnerability
- CVE-2025-0411 7-Zip Mark-of-the-Web Bypass Vulnerability. vulnerability
- CVE-2018-6074 Failure to apply Mark-of-the-Web in Downloads in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to bypass OS level controls… vulnerability
- CVE-2005-2188 McAfee IntruShield Security Management System obtains the user ID from the URL, which allows remote attackers to guess the Manager account… vulnerability
- CVE-2005-0877 Dnsmasq before 2.21 allows remote attackers to poison the DNS cache via answers to queries that were not made by Dnsmasq. vulnerability
- CVE-2003-0981 FreeScripts VisitorBook LE (visitorbook.pl) logs the reverse DNS name of a visiting host, which allows remote attackers to spoof the origin… vulnerability
- CVE-2003-0174 The LDAP name service (nsd) in IRIX 6.5.19 and earlier does not properly verify if the USERPASSWORD attribute has been provided by an LDAP… vulnerability
- CVE-2001-1452 By default, DNS servers on Windows NT 4.0 and Windows 2000 Server cache glue records received from non-delegated name servers, which allows… vulnerability
- CVE-2000-1218 The default configuration for the domain name resolver for Microsoft Windows 98, NT 4.0, 2000, and XP sets the QueryIpMatching parameter to… vulnerability
- CVE-1999-1549 Lynx 2.x does not properly distinguish between internal and external HTML, which may allow a local attacker to read a "secure" hidden form… vulnerability
Child of · CWE (2)
Referenced by CAPEC · weakness (16)
- CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) attack pattern
- CAPEC-141 Cache Poisoning attack pattern
- CAPEC-142 DNS Cache Poisoning attack pattern
- CAPEC-160 Exploit Script-Based APIs attack pattern
- CAPEC-21 Exploitation of Trusted Identifiers attack pattern
- CAPEC-384 Application API Message Manipulation via Man-in-the-Middle attack pattern
- CAPEC-385 Transaction or Event Tampering via Application API Manipulation attack pattern
- CAPEC-386 Application API Navigation Remapping attack pattern
- CAPEC-387 Navigation Remapping To Propagate Malicious Content attack pattern
- CAPEC-388 Application API Button Hijacking attack pattern
- CAPEC-510 SaaS User Request Forgery attack pattern
- CAPEC-59 Session Credential Falsification through Prediction attack pattern
- CAPEC-60 Reusing Session IDs (aka Session Replay) attack pattern
- CAPEC-75 Manipulating Writeable Configuration Files attack pattern
- CAPEC-76 Manipulating Web Input to File System Calls attack pattern
- CAPEC-89 Pharming attack pattern
Referenced by CVE · weakness (860)
- CVE-2026-118651 Echo is a Go web framework. vulnerability
- CVE-2026-118657 Echo is a Go web framework. vulnerability
- CVE-2026-61546 AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard application. vulnerability
- CVE-2026-110737 The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response… vulnerability
- CVE-2026-115413 Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to… vulnerability
- CVE-2026-82121 Origin Validation Error Vulnerability in HiRDB. vulnerability
- CVE-2026-82332 An improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint multi-factor authentication process allows a local,… vulnerability
- CVE-2026-116254 A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. vulnerability
- CVE-2026-116194 Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback,… vulnerability
- CVE-2026-115724 VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based… vulnerability
- CVE-2026-58497 Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. vulnerability
- CVE-2026-79977 The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. vulnerability
- CVE-2026-83813 Twisted is an event-based framework for internet applications, supporting Python 3.6+. vulnerability
- CVE-2026-112085 webpack-dev-server is a development server that provides live reloading for webpack projects. vulnerability
- CVE-2026-113798 Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. vulnerability
- CVE-2026-113800 Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. vulnerability
- CVE-2026-114121 Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. vulnerability
- CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in isolation. vulnerability
- CVE-2026-112101 A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. vulnerability
- CVE-2026-112377 CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing… vulnerability
- CVE-2026-108372 Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. vulnerability
- CVE-2026-109461 Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over… vulnerability
- CVE-2026-109829 undici is an HTTP client library for Node.js. vulnerability
- CVE-2026-55587 AliasVault is a privacy-first password manager with built-in email aliasing. vulnerability
- CVE-2026-55842 Scoold is a Q&A and a knowledge sharing platform for teams. vulnerability
- CVE-2026-101897 Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. vulnerability
- CVE-2026-103417 Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. vulnerability
- CVE-2026-109759 Site isolation issue in the Networking component. vulnerability
- CVE-2026-109772 Same-origin policy bypass in the DevTools component. vulnerability
- CVE-2026-69877 Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a network. vulnerability
Referenced by CWE · child of (2)
Referenced by CWE · peer of (1)
- CWE-451 User Interface (UI) Misrepresentation of Critical Information weakness