Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
`webauthn_account_id` uses `super || ...` without checking the current route. If a user is already authenticated, `super` resolves to the active session's account ID rather than the target account being authenticated, leading to authentication bypass or account takeover.
A static or hardcoded string literal is used for the JWT 'sub' (subject) claim. The 'sub' claim in a JWT must uniquely identify the principal or user account to prevent token identity collision and authorization bypass.
Weak biometric ACL flag is associated with a key stored in Keychain. With '.biometryAny/.userPresence/.touchIDAny' flag, an attacker with the ability to add a biometry to the device can authenticate as the user. It is recommended to use more specific and secure authentication mechanisms like '.biometryCurrentSet' and '.touchIDCurrentSet'. Here's an example o
SwiftCWE-305A key stored in the Keychain is using a weak accessibility value. kSecAttrAccessibleAlways allows access to the keychain item at all times, even when the device is locked. Storing sensitive data with this accessibility option means that the data is accessible to anyone who gains physical access to the device, regardless of whether it's locked or not. This in
SwiftCWE-305
