Skip to content
Log inStart free trial

CWE-940: Improper Verification of Source of a Communication Channel

Base

The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.

When an attacker can successfully establish a communication channel from an untrusted origin, the attacker may be able to gain privileges and access unexpected functionality.

Consequences

  • Access Control, Other: Gain Privileges or Assume Identity, Varies by Context, Bypass Protection Mechanism

How to prevent it

  • Architecture and Design: Use a mechanism that can validate the identity of the source, such as a certificate, and validate the integrity of data to ensure that it cannot be modified in transit using an Adversary-in-the-Middle (AITM) attack. When designing functionality of actions in the URL scheme, consider whether the action should be accessible to all mobile applications, or if an allowlist of applications to interface with is appropriate.

Recent advisories

  • GHSA-hm92-r4w5-c3mj — undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
  • GHSA-67c5-x5mf-rppq — MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution
  • GHSA-5hgj-7gm9-cff5 — AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address
  • GHSA-cxmw-p77q-wchg — OpenClaw: Arbitrary code execution via unvalidated WebView JavascriptInterface
  • CVE-2025-61932 — Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an…
  • GHSA-vh43-cc6x-prpr — usememos/memos vulnerable to Improper Verification of Source of a Communication Channel
  • GHSA-mfvq-m3jj-8864 — usememos/memos vulnerable to Improper Verification of Source of a Communication Channel
  • GHSA-9hjv-9h75-xmpp — Improper Verification of Source of a Communication Channel in Apache Tomcat

All advisories for CWE-940

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor