CWEweakness
CWE-694 Use of Multiple Resources with Duplicate Identifier
- Abstraction
- Base
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.
Common consequences
• Other: Varies by Context — If the product assumes that each resource has a unique identifier, the product could operate on the wrong resource if attackers can cause multiple resources to be associated with the same identifier.
• Access Control: Bypass Protection Mechanism — If unique identifiers are assumed when protecting sensitive resources, then duplicate identifiers might allow attackers to bypass the protection.
• Other: Quality Degradation
Potential mitigations
• [Architecture and Design] Where possible, use unique identifiers. If non-unique identifiers are detected, then do not operate any resource with a non-unique identifier and report the error appropriately.
Observed examples
• CVE-2013-4787: Chain: mobile OS verifies cryptographic signature of file in an archive, but then installs a different file with the same name that is also listed in the archive.
Related
Observed example · CVE (1)
- CVE-2013-4787 Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows attackers to… vulnerability
Child of · CWE (2)
Referenced by CVE · weakness (17)
- CVE-2026-114643 The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type… vulnerability
- CVE-2026-112906 filelock is a platform-independent file lock for Python. vulnerability
- CVE-2026-78359 OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. vulnerability
- CVE-2026-108752 JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's… vulnerability
- CVE-2026-102634 SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with… vulnerability
- CVE-2026-71327 Traefik is an open source HTTP reverse proxy and load balancer. vulnerability
- CVE-2026-63976 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success… vulnerability
- CVE-2026-57024 A Use of Multiple Resources with Duplicate Identifier vulnerability in the IKE daemon (iked) of Juniper Networks Junos OS on MX with SPC3… vulnerability
- CVE-2026-5794 A vulnerability affecting the detailed versions of Cryptobox allows a legitimate user to prevent another to login by triggering an account… vulnerability
- CVE-2025-13609 A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted… vulnerability
- CVE-2025-59048 OpenBao's AWS Plugin generates AWS access credentials based on IAM policies. vulnerability
- CVE-2024-41146 Use of Multiple Resources with Duplicate Identifier (CWE-694) in the Controller 6000 and Controller 7000 Platforms could allow an attacker… vulnerability
- CVE-2022-23721 PingID integration for Windows login prior to 2.9 does not handle duplicate usernames, which can lead to a username collision when two… vulnerability
- CVE-2023-20100 A vulnerability in the access point (AP) joining process of the Control and Provisioning of Wireless Access Points (CAPWAP) protocol of… vulnerability
- CVE-2021-3436 BT: Possible to overwrite an existing bond during keys distribution phase when the identity address of the bond is known. vulnerability
- CVE-2020-15185 In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. vulnerability
- CVE-2020-15187 In Helm before versions 2.16.11 and 3.3.2, a Helm plugin can contain duplicates of the same entry, with the last one always used. vulnerability