CWE-325: Missing Cryptographic Step
Base
The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.
Consequences
- Access Control: Bypass Protection Mechanism
- Confidentiality, Integrity: Read Application Data, Modify Application Data
- Accountability, Non-Repudiation: Hide Activities
Recent advisories
- GHSA-9xg4-qhm4-g43w — Deno: Miller-Rabin Primality Test Allows Zero Rounds
- GHSA-vcgp-9326-pqcp — net-imap vulnerable to STARTTLS stripping via invalid response timing
- GHSA-8689-gm9g-jgr6 — OpenClaw: Voice-call Plivo V3 webhook replay key uses unsorted URL, allowing replay via query-parameter reordering
- GHSA-5379-f5hf-w38v — Deno node:crypto doesn't finalize cipher
- GHSA-mr45-rx8q-wcm9 — xkeys seal encryption used fixed key for all encryption
- GHSA-m5vr-3m74-jwxp — Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor