CWE-696: Incorrect Behavior Order

Class

The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.

Consequences

Integrity: Alter Execution Logic

Recent advisories

GHSA-83vg-56qc-22m7 — GitPython validates a submodule's ".git" path only after cloning into it (RCE)
GHSA-m65r-rprj-r5rg — Russh: Channel-scoped server callbacks can be reached without an open channel
GHSA-3h52-cx59-c456 — OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation
GHSA-q2qc-744p-66r2 — OpenClaw: `session_status` sessionId resolution bypasses sandboxed session-tree visibility
GHSA-vfg3-pqpq-93m4 — OpenClaw: Tlon cite expansion happens before channel and DM authorization is complete
GHSA-8883-9w57-vwv6 — OpenClaw: Mattermost callback dispatch allowed non-allowlisted sender actions
GHSA-65h8-27jh-q8wv — OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement

All advisories for CWE-696

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor