CWE-345 vulnerabilities

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4.

CVE-2026-55103 is a vulnerability in the discourse-activity-pub plugin for Discourse that allows remote attackers to edit, delete, or reply to federated posts without proper permissions due to insufficient verification of the actor's identity and ownership. This flaw existed prior to a specific commit that fixed the issue by ensuring the actor authenticated by the signed request matches the Activity actor and owns the referenced post.

The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including marking unpaid orders as paid and cancelling completed orders.

The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including orders that were already paid or completed.

The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an approved-payment notification and mark arbitrary orders as paid, or force them to failed.

FileRise versions prior to 3.23.0 contain an improper authentication vulnerability where the software maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims without requiring email verification. This allows an attacker who can obtain provider-issued claims that collide with an existing local username to log in as that user, including the administrator, even if automatic provisioning is disabled. The vulnerability is fixed in version 3.23.0.

Pipecat-ai pipecat versions from 0.0.98 up to but not including 1.6.0 include a development runner exposing unauthenticated endpoints for creating bot sessions and Daily rooms. These endpoints are bound to localhost by default and intended only for local development. Exploitation requires deliberate exposure of the runner to untrusted networks. Version 1.6.0 adds warnings and documentation directing users to authenticated or managed production deployments but does not change endpoint behavior.

OmniFaces versions prior to 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2 contain a vulnerability in CombinedResourceHandler where it accepts a structurally valid deflated and base64 encoded combined resource ID without verifying its authenticity. This allows attackers to forge IDs that can cause unbounded decoded output, memory exhaustion, and limited disclosure of Facelets source files. Additionally, in certain configurations, a forged ID can trigger a blind server-side fetch influenced by the request Host header. The issue is fixed in the stated versions.

The Tickera WordPress plugin versions before 3.6.0.4 contain a vulnerability where incoming payment notifications are not properly verified. The signature validation does not cover critical fields such as the order or payment amount, enabling attackers to forge payment confirmations and mark orders as paid without actual payment.

WPForms Lite versions from 1.10.0.1 up to but not including 2.0.2.2 contain a vulnerability where the plugin does not verify server-side that a PayPal payment was completed before accepting form submissions. This allows unauthenticated users to submit forms that require payment without actually paying, triggering confirmation messages and notification emails despite no payment being recorded.

Visma Pay for WooCommerce versions before 1.2.2 contain a vulnerability where the plugin does not verify the authenticity of payment gateway return requests if the merchant secret is empty. This allows unauthenticated attackers to mark arbitrary orders as paid and access customer information such as name, email, and postal address.

Sunshine Photo Cart WordPress plugin versions before 3.7.4 allow unauthenticated attackers to submit comments to restricted galleries without verifying access permissions. This flaw permits injection of attacker-chosen content with arbitrary author names and emails into galleries that are password-protected, email-gated, private, account-only, or expired. The plugin properly checks permissions when displaying comments but fails to do so on comment submission.

CVE-2026-107160 is a vulnerability in the LTL Freight Quotes WordPress plugin versions before 4.2.19. The plugin fails to perform authorization checks or input sanitization when storing certain request values, allowing unauthenticated users to inject HTML and links that are rendered to storefront visitors. This can lead to integrity issues on the website content.

CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device.

CVE-2026-49483 is a high-severity vulnerability in the codefori vscode-ibmi Visual Studio Code extension prior to version 3.0.1. The issue involves incorrect permission assignment for IBMi components, allowing local accounts to alter programs due to broad public permissions and insufficient integrity verification. The vulnerability is fixed in version 3.0.1.

CVE-2026-21138 is a vulnerability in Samsung Mobile Smart Switch prior to version 3.7.73 where insufficient verification of data authenticity allows physical attackers to install arbitrary applications on the device. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No patch or remediation information is provided in the available data. The vulnerability requires physical access and does not require user interaction or privileges. No known exploits are reported in the wild.

CVE-2026-107420 is a medium severity vulnerability affecting Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway versions up to 1.7.2. It involves insufficient verification of data authenticity, allowing unauthenticated bypass. This could lead to integrity issues but does not impact confidentiality or availability.

Vikunja versions 1.0.0 through 2.3.0 contain an improper authentication vulnerability in the OpenID Connect provider's email fallback feature. When enabled, the system links an SSO login to a local account using only the email claim without verifying the email or requiring the account password. This allows an attacker who obtains a token with a victim's email to log in as that victim without their consent. The issue is fixed in version 2.4.0.

CVE-2026-13257 is a vulnerability in IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. It allows an authenticated user to forge signature requests due to insufficient verification of data authenticity. The vulnerability has a medium severity with a CVSS score of 6.5, indicating a moderate impact on integrity without affecting confidentiality or availability.

The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no webhook secret has been configured, allowing unauthenticated attackers to forge one and mark orders as paid without paying.