Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
A session was retrieved by ID and restored/bound without checking ownership. This logic allows a session hijacking attack if an attacker supplies a victim's session ID. Verify that the session owner matches the currently authenticated user before performing the binding.
Using `URL(scope=...).path` for path evaluation in ASGI middleware is vulnerable to Host header injection, enabling path parsing confusion. This allows attackers to bypass path-based routing, authentication, or authorization logic by injecting URL characters like `?` into the Host header. Direct your checks against the raw ASGI request path from the scope us
NFS filehandles are decoded using an exportfs decode function without cryptographic verification. Because standard NFS filehandles are traditionally predictable, an unauthenticated network attacker can guess them to bypass path-based access controls and access restricted files. Ensure incoming filehandles are cryptographically verified (e.g., using `fh_verif
Decoding a network-provided filehandle via `exportfs_decode_fh_raw` without cryptographic verification (e.g., checking NFSEXP_SIGN_FH and verifying a MAC). This allows predictable filehandles to be spoofed by attackers, bypassing access controls.
A session is created unconditionally after a password verification, bypassing Multi-Factor Authentication if it is configured.
Instantiating a remote ContextServer purely with static configuration headers omits programmatic OAuth authentication, which may allow interception or bypass.
The HTTP context server is initialized using only static headers without dynamic OAuth token provisioning. This can bypass secure remote server authentication. Migrate to an implementation that provisions dynamic tokens (e.g., via a token provider).
An initialization function with no configuration parameter assigns a randomly generated UUID (uuid.New().String()) directly to an NF instance ID field. A non-persistent, non-configurable NF instance ID breaks NRF registration continuity: because OAuth2Required defaults to false and is only set true after successful NRF registration, an ever-changing instance
'$VAR.ID' is assigned by hashing its own current (uninitialized) value. If '$VAR' was freshly allocated with a zero-value struct literal, '$VAR.ID' is the empty string at this point, so every OAuth user receives the same derived identity — the hash of "" — enabling cross-account access and privilege confusion (CWE-287, CVE-2026-42560). Use the actual externa
Generating a session or CSRF binding cookie proactively inside a global middleware can lead to security bypasses if attackers can obtain valid session bindings without authentic API login. Ensure cookie provisioning is restricted to explicit login routes.
Authentication function compares the supplied plaintext against a placeholder bcrypt hash when the user's stored password is empty (a CWE-208 timing-attack mitigation), but the success guard only checks `err == nil` without also requiring that the stored password is non-empty. An unauthenticated attacker who submits the plaintext that matches the placeholder
A custom HTTP stream reader is created from an HTTP request body but fails to clear or sanitize `req.Trailer`. Go's `net/http` server automatically populates this field with trailing headers upon reading a chunked request. If the application later trusts these unverified trailers (e.g., for metadata or chunk signatures), attackers can smuggle unsigned traili
An authentication denial branch in an OpenVPN plugin handler returns a success status code (OPENVPN_PLUGIN_FUNC_SUCCESS). OpenVPN only consults auth_control_file when the plugin returns FUNC_DEFERRED; returning FUNC_SUCCESS causes OpenVPN to immediately admit the client as fully authenticated regardless of any denial written to the file. This results in comp
Trusting the client-provided scheme without verifying the underlying secure channel state can lead to transport-state spoofing. An attacker can supply "https" via an absolute-form HTTP request or HTTP/2 `:scheme` pseudo-header over a plaintext connection to mislead security decisions.
Rack::Session::Cookie#unpacked_cookie_data falls back to an unauthenticated coder (e.g. Base64::Marshal) when configured encryptors fail to decrypt the cookie. Because encryptor failures are rescued and ignored, an attacker can forge a session cookie that fails authenticated decryption but is still parsed by the fallback coder, leading to authentication bypa
A JWT token parsed with `jwt.Parse` or `jwt.ParseWithClaims` is accessed by checking if it is non-nil without also verifying the token's validity (`token.Valid`) or checking the returned error. Invalid tokens (e.g., forged signatures) may still evaluate as non-nil, leading to authentication bypass. Always check `token.Valid` or ensure the parsing error is ha
The `handle_start` method of a GraphQL WebSocket handler processes subscription messages without first checking if the connection has been initialized and acknowledged. This allows attackers to bypass authentication implemented in the `connection_init` hook (e.g., `on_ws_connect`) by sending a `start` message directly. Ensure that a property like `self.conne
Unconditional extraction of a SAML assertion element via array indexing (e.g., `assertion[0]`) without ensuring exactly one assertion is present. This weak validation pattern enables SAML Assertion Wrapping (XML Signature Wrapping) vulnerabilities. An attacker may inject an unsigned forged assertion alongside a legitimately signed assertion to bypass authent
An authentication token is retrieved with an empty string default and passed directly to a validation callback without checking its truthiness. If the underlying data store contains an empty string token, this could lead to authentication bypass. Ensure the token is validated to be truthy before passing it to the validator.
Overwriting an existing session stream without checking if one already exists can lead to session hijacking.
Identifying a leaf certificate in an unordered PKCS#7 bag by simply finding a certificate whose subject does not match any other certificate's issuer is insecure. An attacker can trick this heuristic by injecting a spoofed certificate that matches the target requirements and does not act as an issuer. Instead, identify the leaf certificate using cryptographi
JWT validation via lcobucci/jwt does not include a `SignedWith` constraint. Only time-based or other non-cryptographic constraints are passed to `validator()->validate()` / `validator()->assert()`, so the token's cryptographic signature is never verified. An attacker can forge or tamper with the JWT payload (e.g. impersonate any user via a `user_uuid` claim)
Using an authorization token directly as the sole cache key without scoping it (e.g., to an introspection endpoint, audience, or tenant API URL) can lead to cache key confusion. An attacker could use a token validated for one endpoint to access a different endpoint if they share the cache. Scoping the cache key by incorporating the endpoint or configuration
The handler passed to h2c.NewHandler does not include authentication middleware: the auth middleware is wrapped around the result of h2c.NewHandler instead of around its input. When a client performs an HTTP/2 cleartext (h2c) upgrade, the h2c handler hijacks the TCP connection and dispatches all subsequent HTTP/2 requests through the inner handler captured a
