CWEweakness
CWE-940 Improper Verification of Source of a Communication Channel
- Abstraction
- Base
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.
Common consequences
• Access Control, Other: Gain Privileges or Assume Identity, Varies by Context, Bypass Protection Mechanism — An attacker from an untrusted origin could successfully establish a communication channel. The attacker could then gain privileges and access unexpected functionality that was only intended for trusted sources.
Potential mitigations
• [Architecture and Design] Use a mechanism that can validate the identity of the source, such as a certificate, and validate the integrity of data to ensure that it cannot be modified in transit using an Adversary-in-the-Middle (AITM) attack.
When designing functionality of actions in the URL scheme, consider whether the action should be accessible to all mobile applications, or if an allowlist of applications to interface with is appropriate.
Observed examples
• CVE-2025-3651: desktop product does not properly verify the source of a communication channel, allowing command execution
• CVE-2000-1218: DNS server can accept DNS updates from hosts that it did not query, leading to cache poisoning
• CVE-2005-0877: DNS server can accept DNS updates from hosts that it did not query, leading to cache poisoning
• CVE-2001-1452: DNS server caches glue records received from non-delegated name servers
Related
Attack pattern · CAPEC (4)
Observed example · CVE (4)
- CVE-2025-3651 Improper Verification of Source of a Communication Channel in Work Desktop for Mac versions 10.8.1.46 and earlier allows attackers to… vulnerability
- CVE-2005-0877 Dnsmasq before 2.21 allows remote attackers to poison the DNS cache via answers to queries that were not made by Dnsmasq. vulnerability
- CVE-2001-1452 By default, DNS servers on Windows NT 4.0 and Windows 2000 Server cache glue records received from non-delegated name servers, which allows… vulnerability
- CVE-2000-1218 The default configuration for the domain name resolver for Microsoft Windows 98, NT 4.0, 2000, and XP sets the QueryIpMatching parameter to… vulnerability
Child of · CWE (2)
Referenced by CAPEC · weakness (4)
Referenced by CVE · weakness (71)
- CVE-2026-66279 In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication… vulnerability
- CVE-2026-89409 In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and earlier (for 500 series devices), missing checks in the… vulnerability
- CVE-2026-112408 Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0… vulnerability
- CVE-2026-102551 Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before… vulnerability
- CVE-2026-102552 Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow… vulnerability
- CVE-2026-101897 Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. vulnerability
- CVE-2026-87705 Improper verification of source of a communication channel in Windows Hyper-V allows an unauthorized attacker to bypass a security feature… vulnerability
- CVE-2026-94590 Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation… vulnerability
- CVE-2026-59786 Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. vulnerability
- CVE-2026-102117 On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the… vulnerability
- CVE-2026-102511 Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X (PLC4Go) allows an… vulnerability
- CVE-2026-85125 The Android application "YAMAP -Social Trekking GPS App" contains an improper access control vulnerability in its WebView implementation. vulnerability
- CVE-2026-89178 WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. vulnerability
- CVE-2026-85085 The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. vulnerability
- CVE-2026-78685 Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. vulnerability
- CVE-2026-73419 NextAuth.js provides authentication for Next.js. vulnerability
- CVE-2026-55660 Tina is a headless content management system. vulnerability
- CVE-2026-54106 The U.S. vulnerability
- CVE-2026-48745 Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Traccar platform. vulnerability
- CVE-2026-6734 Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's… vulnerability
- CVE-2026-44894 Netty is a network application framework for development of protocol servers and clients. vulnerability
- CVE-2026-44698 Home Assistant is open source home automation software that puts local control and privacy first. vulnerability
- CVE-2026-45353 electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. vulnerability
- CVE-2026-2611 In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. vulnerability
- CVE-2026-45245 Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover… vulnerability
- CVE-2026-43880 WWBN AVideo is an open source video platform. vulnerability
- CVE-2026-23866 Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for… vulnerability
- CVE-2026-40434 Anviz CrossChex Standard lacks source verification in the client/server channel, enabling TCP packet injection by an attacker on the same… vulnerability
- CVE-2026-35643 OpenClaw before 2026.3.22 contains an unvalidated WebView JavascriptInterface vulnerability allowing attackers to inject arbitrary… vulnerability
- CVE-2026-33875 Gematik Authenticator securely authenticates users for login to digital health applications. vulnerability