CWE-348: Use of Less Trusted Source

The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

Consequences

• Access Control: Bypass Protection Mechanism, Gain Privileges or Assume Identity

Recent advisories

• GHSA-x33g-cr3x-6449 — PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion
• PYSEC-2026-4324 — vLLM is an inference and serving engine for large language models.
• GHSA-jqcg-44mw-7w3h — proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
• GHSA-3m5p-2c4r-xxw2 — fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
• GHSA-86m2-fcxq-5q7c — 9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF
• GHSA-xgm2-5f3f-mvvc — Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication
• GHSA-wgpf-jwqj-8h8p — hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest
• GHSA-3xv9-89fm-7h4r — OpenClaw: diffs viewer misclassifies proxied remote requests as loopback when `allowRemoteViewer` is disabled
• GHSA-8p2x-5cpm-qrqw — AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()
• GHSA-444r-cwp2-x5xf — fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections
• GHSA-62c8-mh53-4cqv — HTTP client can manipulate custom HTTP headers that are added by Traefik

All advisories for CWE-348