CWE-345: Insufficient Verification of Data Authenticity
Class
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Consequences
- Integrity, Other: Varies by Context, Unexpected State
Recent advisories
- GHSA-rfpc-qcw5-3pc4 — filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker
- GHSA-7hp6-4w63-5g45 — LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
- GHSA-p92p-rxj5-7p2x — vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine
- GHSA-r4xp-prcw-77qf — better-auth: OAuth Proxy lets an attacker sign in as another user
- GHSA-xv7q-fvmc-jx96 — Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover
- GHSA-4f6c-2vvp-gw82 — Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write
- GHSA-qmv3-fv6v-rmhq — Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
- GHSA-x33g-cr3x-6449 — PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion
- GHSA-9v7f-9g4p-ffgj — PyJWT: PyJWKClient follows redirects when fetching JWKS
- GHSA-8436-99hf-9mmv — undici vulnerable to caching and replay of unsafe HTTP method responses
- PYSEC-2026-3781 — openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed…
- PYSEC-2026-3962 — openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public…
- GHSA-rpx2-p6hp-x5gj — SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin
- EEF-CVE-2026-53425 — Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses
- PYSEC-2026-3766 — openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when…
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor