CWE-322 Key Exchange without Entity Authentication
Description
The product performs a key exchange with an actor without verifying the identity of that actor.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-322 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-vjfw-cpmh-xwv3 | CVE-2026-11745 | HIGH |
Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror) |
2026-09-11 | |
| GHSA-hqvf-45jj-mccq | CVE-2026-18654 | MODERATE |
AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands |
2026-08-06 | |
| GHSA-g9v5-gjwf-9rwx | CVE-2026-45361 | HIGH |
Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default |
2026-06-30 | |
| GHSA-mxg3-432p-mr72 | - | HIGH |
goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request |
2026-05-15 | |
| GHSA-27jc-jmp8-qfw5 | - | CRITICAL |
Duplicate Advisory: Keylime Missing Authentication for Critical Function and Improper Authentication |
2026-02-09 | |
| GHSA-cm7j-p8hc-97vj | CVE-2022-36881 | MODERATE |
Jenkins Git client plugin 3.11.0 does not perform SSH host key verification |
2022-12-12 | |
| GHSA-5w8r-8pgj-5jmf | CVE-2022-39250 | HIGH |
matrix-js-sdk subject to user impersonation due to key/device identifier confusion in SAS verification |
2022-11-01 | |
| GHSA-r48r-j8fx-mq2c | CVE-2022-39251 | HIGH |
matrix-js-sdk subject to user spoofing via Olm/Megolm protocol confusion |
2022-10-03 | |
| GHSA-w4pr-4vjg-hffh | CVE-2022-39254 | HIGH |
When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarder |
2022-09-30 | |
| GHSA-fpgf-pjjv-2qgm | CVE-2022-39248 | HIGH |
matrix-android-sdk2 vulnerable to Olm/Megolm protocol confusion |
2022-09-30 | |
| GHSA-2pvj-p485-cp3m | CVE-2022-39246 | HIGH |
matrix-android-sdk2 vulnerable to impersonation via forwarded Megolm sessions |
2022-09-30 |