CWE-940 Improper Verification of Source of a Communication Channel
Description
The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-940 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-vqff-r82h-9crc | CVE-2026-76894 | LOW |
ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out) |
2026-10-16 | |
| GHSA-67c5-x5mf-rppq | CVE-2026-2611 | CRITICAL |
MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution |
2026-10-05 | |
| GHSA-x445-f3h2-j279 | CVE-2026-73419 | MODERATE |
Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them |
2026-08-13 | |
| GHSA-7p5m-v798-f8vv | CVE-2026-45353 | CRITICAL |
Electerm Local code through electerm's single-instance socket |
2026-07-06 | |
| GHSA-g5qx-h5f3-mp2f | CVE-2026-55660 | HIGH |
TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover |
2026-06-19 | |
| GHSA-cmm3-54f8-px4j | CVE-2026-44894 | HIGH |
Netty's Default QUIC token handler accepts any client-supplied token |
2026-06-12 | |
| GHSA-x426-x7cc-3fpc | CVE-2026-48022 | MODERATE |
@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects |
2026-06-11 | |
| GHSA-5hgj-7gm9-cff5 | CVE-2026-43880 | MODERATE | - |
AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address |
2026-05-13 |
| GHSA-cxmw-p77q-wchg | CVE-2026-35643 | HIGH |
OpenClaw: Arbitrary code execution via unvalidated WebView JavascriptInterface |
2026-04-10 | |
| GHSA-7cxj-w27x-x78q | CVE-2025-59159 | CRITICAL |
SillyTavern Web Interface Vulnerable DNS Rebinding |
2025-10-06 | |
| GHSA-m3pm-rpgg-5wj6 | CVE-2025-25305 | HIGH |
Home Assistant does not correctly validate SSL for outgoing requests in core and used libs |
2025-02-18 | |
| GHSA-c35g-jr5f-h83p | CVE-2017-5591 | MODERATE |
SleekXMPP and Slixmpp Incorrect Implementation of Message Carbons |
2024-10-22 | |
| GHSA-g8fc-vrcg-8vjg | - | HIGH |
Constallation has pods exposed to peers in VPC |
2024-06-04 | |
| GHSA-9hjv-9h75-xmpp | CVE-2016-0763 | MODERATE |
Improper Verification of Source of a Communication Channel in Apache Tomcat |
2024-02-22 | |
| GHSA-vh43-cc6x-prpr | CVE-2022-4848 | MODERATE |
usememos/memos vulnerable to Improper Verification of Source of a Communication Channel |
2023-01-10 | |
| GHSA-mfvq-m3jj-8864 | CVE-2022-4800 | MODERATE |
usememos/memos vulnerable to Improper Verification of Source of a Communication Channel |
2023-01-10 | |
| GHSA-w6v7-w58j-pg5r | CVE-2021-41038 | MODERATE |
Improper Verification of Communication Channel in @theia/plugin-ext |
2021-11-15 |