CWE-408: Incorrect Behavior Order: Early Amplification

Base

The product allows an entity to perform a legitimate but expensive operation before authentication or authorization has taken place.

Consequences

Availability: DoS: Amplification, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)

Recent advisories

GHSA-m6fx-m8hc-572m — OpenClaw: Telegram audio preflight transcription enables resource consumption by unauthorized senders
GHSA-hhff-fj5f-qg48 — OpenClaw runs Discord audio preflight transcription before member authorization
GHSA-p464-m8x6-vhv8 — OpenClaw: MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion

All advisories for CWE-408

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor