CWE-565
Reliance on Cookies without Validation and Integrity Checking
Description
The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-226 · CAPEC-31 · CAPEC-39
CVEs mapped to this weakness (80)
page 2 of 4| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-6896 | Hig | 0.60 | 8.8 | 0.04 | Mar 14, 2017 | Privilege escalation vulnerability on the DIGISOL DG-HR1400 1.00.02 wireless router enables an attacker to escalate from user privilege to admin privilege just by modifying the Base64-encoded session cookie value. | ||
| CVE-2023-45128 | Cri | 0.58 | 10.0 | 0.00 | Oct 16, 2023 | Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vulnerability can allow… | ||
| CVE-2026-39324 | Cri | 0.57 | 9.8 | 0.00 | Apr 7, 2026 | Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie decryption fails, the implementation falls back to a default decoder instead of… | ||
| CVE-2025-14440 | Cri | 0.57 | 9.8 | 0.01 | Dec 13, 2025 | The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authentication checking in the 'jay_login_register_process_switch_back' function with the… | ||
| CVE-2021-47706 | Hig | 0.57 | — | 0.01 | Dec 9, 2025 | COMMAX Biometric Access Control System 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access sensitive information and circumvent physical controls in smart homes and buildings by exploiting cookie poisoning. Attackers can forge… | ||
| CVE-2025-59247 | Hig | 0.57 | 8.8 | 0.02 | Oct 9, 2025 | Azure PlayFab Elevation of Privilege Vulnerability | ||
| CVE-2024-9970 | Hig | 0.57 | 8.8 | 0.01 | Oct 15, 2024 | The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular privileges can elevate their privileges to administrator by tampering with a specific cookie. | ||
| CVE-2024-22186 | — | Hig | 0.57 | 8.8 | 0.01 | Apr 18, 2024 | The application suffers from a privilege escalation vulnerability. An attacker logged in as guest can escalate his privileges by poisoning the cookie to become administrator. | |
| CVE-2021-33842 | Hig | 0.57 | 8.8 | 0.00 | Jun 9, 2021 | Improper Authentication vulnerability in the cookie parameter of Circutor SGE-PLC1000 firmware version 0.9.2b allows an attacker to perform operations as an authenticated user. In order to exploit this vulnerability, the attacker must be within the network where the device… | ||
| CVE-2012-5631 | Hig | 0.57 | 8.8 | 0.02 | Nov 25, 2019 | ipa 3.0 does not properly check server identity before sending credential containing cookies | ||
| CVE-2024-55211 | Hig | 0.55 | 8.4 | 0.00 | Apr 17, 2025 | An issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass authentication via a crafted cookie. | ||
| CVE-2025-64447 | Hig | 0.53 | 8.1 | 0.08 | Dec 9, 2025 | A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an unauthenticated attacker… | ||
| CVE-2022-30620 | Hig | 0.53 | 8.2 | 0.01 | Jul 18, 2022 | On Cellinx Camera with guest enabled, attacker with web access can elevate privileges to administrative: "1" to "0" privileges by changing the following cookie values from "is_admin", "showConfig". Administrative Privileges which allows changing various configuration in the… | ||
| CVE-2026-76186 | Cri | 0.52 | 9.1 | 0.01 | Sep 16, 2026 | Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated cookies, and never… | ||
| CVE-2026-5130 | Hig | 0.50 | 8.8 | 0.00 | Mar 30, 2026 | The Debugger & Troubleshooter plugin for WordPress was vulnerable to Unauthenticated Privilege Escalation in versions up to and including 1.3.2. This was due to the plugin accepting the wp_debug_troubleshoot_simulate_user cookie value directly as a user ID without any… | ||
| CVE-2024-21872 | — | Hig | 0.49 | 7.5 | 0.01 | Apr 18, 2024 | The device allows an unauthenticated attacker to bypass authentication and modify the cookie to reveal hidden pages that allows more critical operations to the transmitter. | |
| CVE-2023-45141 | Hig | 0.49 | 8.6 | 0.00 | Oct 16, 2023 | Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to unauthorized actions… | ||
| CVE-2022-35284 | Hig | 0.49 | 7.5 | 0.01 | Jul 25, 2022 | IBM Security Verify Information Queue 10.0.2 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie. IBM X-Force ID: 230811. | ||
| CVE-2021-41819 | Hig | 0.49 | 7.5 | 0.03 | Jan 1, 2022 | CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby. | ||
| CVE-2019-17104 | Hig | 0.49 | 7.5 | 0.02 | Oct 8, 2019 | In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set. |
- risk 0.60cvss 8.8epss 0.04
Privilege escalation vulnerability on the DIGISOL DG-HR1400 1.00.02 wireless router enables an attacker to escalate from user privilege to admin privilege just by modifying the Base64-encoded session cookie value.
- risk 0.58cvss 10.0epss 0.00
Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vulnerability can allow…
- risk 0.57cvss 9.8epss 0.00
Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie decryption fails, the implementation falls back to a default decoder instead of…
- risk 0.57cvss 9.8epss 0.01
The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authentication checking in the 'jay_login_register_process_switch_back' function with the…
- risk 0.57cvss —epss 0.01
COMMAX Biometric Access Control System 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access sensitive information and circumvent physical controls in smart homes and buildings by exploiting cookie poisoning. Attackers can forge…
- risk 0.57cvss 8.8epss 0.02
Azure PlayFab Elevation of Privilege Vulnerability
- risk 0.57cvss 8.8epss 0.01
The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular privileges can elevate their privileges to administrator by tampering with a specific cookie.
- risk 0.57cvss 8.8epss 0.01
The application suffers from a privilege escalation vulnerability. An attacker logged in as guest can escalate his privileges by poisoning the cookie to become administrator.
- risk 0.57cvss 8.8epss 0.00
Improper Authentication vulnerability in the cookie parameter of Circutor SGE-PLC1000 firmware version 0.9.2b allows an attacker to perform operations as an authenticated user. In order to exploit this vulnerability, the attacker must be within the network where the device…
- risk 0.57cvss 8.8epss 0.02
ipa 3.0 does not properly check server identity before sending credential containing cookies
- risk 0.55cvss 8.4epss 0.00
An issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass authentication via a crafted cookie.
- risk 0.53cvss 8.1epss 0.08
A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an unauthenticated attacker…
- risk 0.53cvss 8.2epss 0.01
On Cellinx Camera with guest enabled, attacker with web access can elevate privileges to administrative: "1" to "0" privileges by changing the following cookie values from "is_admin", "showConfig". Administrative Privileges which allows changing various configuration in the…
- risk 0.52cvss 9.1epss 0.01
Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated cookies, and never…
- risk 0.50cvss 8.8epss 0.00
The Debugger & Troubleshooter plugin for WordPress was vulnerable to Unauthenticated Privilege Escalation in versions up to and including 1.3.2. This was due to the plugin accepting the wp_debug_troubleshoot_simulate_user cookie value directly as a user ID without any…
- risk 0.49cvss 7.5epss 0.01
The device allows an unauthenticated attacker to bypass authentication and modify the cookie to reveal hidden pages that allows more critical operations to the transmitter.
- risk 0.49cvss 8.6epss 0.00
Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to unauthorized actions…
- risk 0.49cvss 7.5epss 0.01
IBM Security Verify Information Queue 10.0.2 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie. IBM X-Force ID: 230811.
- risk 0.49cvss 7.5epss 0.03
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.
- risk 0.49cvss 7.5epss 0.02
In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set.