CWE-1254 Incorrect Comparison Logic Granularity
Description
The product's comparison logic is performed over a series of steps rather than across the entire string in one operation. If there is a comparison logic failure on one of these steps, the operation may be vulnerable to a timing attack that can result in the interception of the process for nefarious purposes.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-1254 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-8fq3-c5w3-pj3q | CVE-2026-34572 | HIGH | - |
CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) |
2026-04-27 |
| GHSA-4vxv-4xq4-p84h | CVE-2026-34570 | HIGH | - |
CI4MS: Account Deletion Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) |
2026-04-06 |
| GHSA-xxvh-5hwj-42pp | CVE-2026-27007 | MODERATE |
OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreation |
2026-02-20 | |
| GHSA-3m6r-39p3-jq25 | CVE-2016-6582 | CRITICAL |
Doorkeeper is vulnerable to replay attacks |
2022-04-25 | |
| GHSA-34r7-q49f-h37c | CVE-2015-8857 | CRITICAL |
Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js |
2021-10-29 |