Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
An authentication credential is built from a browser-ambient source (an HTTP cookie or a URL query parameter) and returned for request authentication. Browsers automatically attach cookies to cross-site requests, so every endpoint that trusts this token is vulnerable to cross-site request forgery (CWE-352): a remote attacker page can make a logged-in adminis
A redirect Location that embeds an issued credential (access/JWT token) and user identity is sent with a raw HttpServletResponse.sendRedirect(). In an SSO flow (OIDC/OAuth2/SAML) whose redirect target originates from a caller-supplied callback parameter (?redirectUri= / ?callback= / RelayState) and is only checked after the token is minted, the server delive
Sensitive request headers such as authentication tokens should not fall back to URL query parameters ($request->query->get()). Passing credentials in query strings exposes them in server access logs, proxy logs, browser history, and HTTP Referer headers.
OAuth2 credentials must be transmitted in the HTTP request body rather than URL query parameters. Instantiating an HTTP request with only the method and URI without a request body causes credentials to be sent in the query string, violating RFC 6749 Section 2.3.1 and risking exposure in logs and traces.
OAuth or bearer tokens should not be accepted from URL query parameters ($request->query), as query parameters can be leaked via server logs, browser history, and HTTP Referer headers. Extract tokens exclusively from the Authorization header instead.
A Livewire form containing a password input uses the `wire:submit` directive without the `.prevent` modifier. In older versions of Livewire, this omission causes the browser to perform a native HTML GET submission by default. This causes sensitive credentials (like user passwords) to leak directly into the URL query string, where they can be cached in browse
Magic login link containing an authentication token is returned to the caller after being delivered by email. If the caller exposes this return value through an HTTP response, an unauthenticated attacker who knows a target email can retrieve the login token directly (CVE-2026-39912). Return only a boolean success indicator instead of the link.
A session credential ($CRED) is written into a URL query value set under the parameter name $KEY, and that same value set is serialized back into a URL ($VALUES.Encode()) inside the same function, so the credential is handed to a client through the front channel (302 Location). Bearer credentials delivered through the front channel leak into browser history,
Retrieving sensitive data from URL query parameters risks exposing it in server access logs, reverse proxy logs, and browser history. Read sensitive data from the HTTP request body instead (e.g., via JSON payload or form data).
