CWE-346: Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

Consequences

• Access Control, Other: Gain Privileges or Assume Identity, Varies by Context

Recent advisories

• GHSA-997q-gvvc-jwmx — Electron: openExternal permission requests can be attributed to the wrong origin
• GHSA-fw47-9c62-h3vw — Electron: HID and USB permission checks can be attributed to the wrong origin
• GHSA-x562-297c-g43g — Electron: Pointer lock permission requests can be attributed to the wrong frame
• GHSA-xcx6-jx8p-x3h5 — MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
• GHSA-4w7w-5xrc-9h26 — undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects
• GHSA-fq6x-pvr9-888r — Microsoft Security Advisory CVE-2026-96234 - .NET and Visual Studio Information Disclosure Vulnerability
• GHSA-9h23-53f4-q947 — Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout
• GHSA-v2j5-22fr-j62r — AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins
• GHSA-pj5h-5q6c-3pfx — Payload external upload trust validation issue
• GHSA-39w2-rjm5-chcv — Next.js has information disclosure in development server's Model Context Protocol endpoint
• GHSA-f87g-xv8r-7p7x — Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass
• GHSA-j84w-jfhq-vhvj — Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
• GHSA-hq2x-r82h-9wj4 — Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
• GHSA-vp8m-p9jh-q5pm — undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors
• EEF-CVE-2026-81315 — MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header

All advisories for CWE-346