CWE-565 · Reliance on Cookies without Validation and Integrity Checking

77 CVEs classified under CWE-565 (Reliance on Cookies without Validation and Integrity Checking). Browse by severity and year.

Top CVEs for CWE-565
CVESeverityScorePublishedSummary
CVE-2023-45128Critical10.02023-10-16Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allow…
CVE-2023-41084Critical10.02023-09-18 Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the…
CVE-2026-85181Critical9.82026-09-03CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline…
CVE-2026-39324Critical9.82026-04-07Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when c…
CVE-2014-125112Critical9.82026-03-26Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution. Plack::Middleware::Session::Cookie versions through 0.21 has a…
CVE-2022-50926Critical9.82026-01-13WAGO 750-8212 PFC200 G2 2ETH RS firmware contains a privilege escalation vulnerability that allows attackers to manipulate user session cookies. Attackers can…
CVE-2025-65212Critical9.82026-01-06An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1. The vulnerability stems from the device's insufficient cookie verification…
CVE-2025-14440Critical9.82025-12-13The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authent…
CVE-2025-2395Critical9.82025-03-17The U-Office Force from e-Excellence has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to use a particular API and alter…
CVE-2024-0947Critical9.82024-06-27Reliance on Cookies without Validation and Integrity Checking vulnerability in Talya Informatics Elektraweb allows Session Credential Falsification through Man…
CVE-2024-28288Critical9.82024-03-30Ruijie RG-NBR700GW 10.3(4b12) router lacks cookie verification when resetting the password, resulting in an administrator password reset vulnerability. An atta…
CVE-2023-35885Critical9.82023-06-20CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.
CVE-2023-3050Critical9.82023-06-13Reliance on Cookies without Validation and Integrity Checking in a Security Decision vulnerability in TMT Lockcell allows Privilege Abuse, Authentication Bypas…
CVE-2022-38297Critical9.82022-09-12UCMS v1.6.0 contains an authentication bypass vulnerability which is exploited via cookie poisoning.
CVE-2021-28171Critical9.82021-04-06The Vangene deltaFlow E-platform does not take properly protective measures. Attackers can obtain privileged permissions remotely by tampering with users’ data…
CVE-2019-7266Critical9.82019-07-02Linear eMerge 50P/5000P devices allow Authentication Bypass.
CVE-2018-20512Critical9.82019-01-03EPON CPE-WiFi devices 2.0.4-X000 are vulnerable to escalation of privileges by sending cooLogin=1, cooUser=admin, and timestamp=-1 cookies.
CVE-2018-5190Critical9.82018-04-17PicturesPro Photo Cart 6 and 7 before Security-Patch-2018-B allows remote attackers to access arbitrary customer accounts via a modified cookie, related to pc_…
CVE-2018-5455Critical9.82018-03-05A Reliance on Cookies without Validation and Integrity Checking issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The…
CVE-2017-7279Critical9.82017-04-12An unprivileged user of the Unitrends Enterprise Backup before 9.0.0 web server can escalate to root privileges by modifying the "token" cookie issued at login.
All CVEs classified under CWE-565 — newest first (page 1 of 1)
CVESeverityScorePublishedSummary
CVE-2026-85181Critical9.82026-09-03CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline…
CVE-2026-757572026-08-31Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind a…
CVE-2026-53871High8.12026-06-17Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cookie() function that accepts unauthenticated profile names fro…
CVE-2026-8337Medium5.32026-05-21Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys. To be vulnerable, a site would have to be configured in such a way that both public and private…
CVE-2026-0257Critical9.12026-05-13Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security res…
CVE-2026-39963Medium6.92026-04-15Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the serendipity_setCookie() function in include/functions_config.inc.php uses $_S…
CVE-2026-39324Critical9.82026-04-07Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when c…
CVE-2026-5130High8.82026-03-30The Debugger & Troubleshooter plugin for WordPress was vulnerable to Unauthenticated Privilege Escalation in versions up to and including 1.3.2. This was due t…
CVE-2014-125112Critical9.82026-03-26Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution. Plack::Middleware::Session::Cookie versions through 0.21 has a…
CVE-2022-50926Critical9.82026-01-13WAGO 750-8212 PFC200 G2 2ETH RS firmware contains a privilege escalation vulnerability that allows attackers to manipulate user session cookies. Attackers can…
CVE-2025-65212Critical9.82026-01-06An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1. The vulnerability stems from the device's insufficient cookie verification…
CVE-2025-14440Critical9.82025-12-13The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authent…
CVE-2021-477062025-12-09COMMAX Biometric Access Control System 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access sensitive informat…
CVE-2025-64447High8.12025-12-09A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb…
CVE-2025-48980Medium6.52025-10-31In Brave Browser Desktop versions prior to 1.83.10 that have the split view feature enabled, the "Open Link in Split View" context menu item did not respect th…
CVE-2025-59247High8.82025-10-09Azure PlayFab Elevation of Privilege Vulnerability
CVE-2025-31120Medium5.32025-04-18NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, an insecure view count mechanism in the forum…
CVE-2024-55211High8.42025-04-17An issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass authentication via a crafted cookie.
CVE-2025-2395Critical9.82025-03-17The U-Office Force from e-Excellence has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to use a particular API and alter…
CVE-2024-9970High8.82024-10-15The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular privileges can elevate their privileges to…
CVE-2024-9820Medium6.52024-10-15The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This is due to the two-f…
CVE-2024-21583Medium4.12024-07-19Versions of the package github.com/gitpod-io/gitpod/components/server/go/pkg/lib before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/com…
CVE-2024-39734Medium4.32024-07-14IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able…
CVE-2024-0947Critical9.82024-06-27Reliance on Cookies without Validation and Integrity Checking vulnerability in Talya Informatics Elektraweb allows Session Credential Falsification through Man…
CVE-2021-20450Medium4.32024-05-03IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the…
CVE-2024-22186High8.82024-04-18The application suffers from a privilege escalation vulnerability. An attacker logged in as guest can escalate his privileges by poisoning the cookie to beco…
CVE-2024-21872High7.52024-04-18The device allows an unauthenticated attacker to bypass authentication and modify the cookie to reveal hidden pages that allows more critical operations to t…
CVE-2024-28288Critical9.82024-03-30Ruijie RG-NBR700GW 10.3(4b12) router lacks cookie verification when resetting the password, resulting in an administrator password reset vulnerability. An atta…
CVE-2024-28233High8.12024-03-27JupyterHub is an open source multi-user server for Jupyter notebooks. By tricking a user into visiting a malicious subdomain, the attacker can achieve an XSS d…
CVE-2024-1551Medium6.12024-02-20Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type response header, as well…
CVE-2023-32725Critical9.62023-12-18The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be use…
CVE-2023-45141High8.62023-10-16Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allow…
CVE-2023-45128Critical10.02023-10-16Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allow…
CVE-2023-41084Critical10.02023-09-18 Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the…
CVE-2023-3747Medium5.52023-09-07Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices. Override codes can also be created by the Administrators…
CVE-2023-32612High7.22023-06-30Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker with an administrat…
CVE-2023-35885Critical9.82023-06-20CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.
CVE-2023-3050Critical9.82023-06-13Reliance on Cookies without Validation and Integrity Checking in a Security Decision vulnerability in TMT Lockcell allows Privilege Abuse, Authentication Bypas…
CVE-2022-3083Low3.92023-02-01All versions of Landis+Gyr E850 (ZMQ200) are vulnerable to CWE-784: Reliance on Cookies Without Validation and Integrity. The device's web application navigati…
CVE-2022-38297Critical9.82022-09-12UCMS v1.6.0 contains an authentication bypass vulnerability which is exploited via cookie poisoning.
CVE-2022-36032Medium5.32022-09-06ReactPHP HTTP is a streaming HTTP client and server implementation for ReactPHP. In ReactPHP's HTTP server component versions starting with 0.7.0 and prior to…
CVE-2022-2615Medium6.52022-08-12Insufficient policy enforcement in Cookies in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVE-2022-35284High7.52022-07-25IBM Security Verify Information Queue 10.0.2 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie. IBM X…
CVE-2022-30620High8.22022-07-18On Cellinx Camera with guest enabled, attacker with web access can elevate privileges to administrative: "1" to "0" privileges by changing the following cookie…
CVE-2016-15002High7.32022-06-09A vulnerability, which was classified as critical, was found in MONyog Ultimate 6.63. This affects an unknown part of the component Cookie Handler. The manipul…
CVE-2022-29248High8.02022-05-25Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not…
CVE-2022-22785Medium5.92022-05-18The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom do…
CVE-2022-28113High7.22022-04-15An issue in upload.csp of FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows attackers to write files and reset the user passwords without having a valid session…
CVE-2022-1148Medium5.32022-04-04Improper authorization in GitLab Pages included with GitLab CE/EE affecting all versions from 11.5 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14…
CVE-2021-36338Medium6.32022-01-21Unisphere for PowerMax versions prior to 9.2.2.2 contains a privilege escalation vulnerability. An adjacent malicious user could potentially exploit this vulne…
CVE-2021-41819High7.52022-01-01CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.
CVE-2021-41263High8.32021-11-15rails_multisite provides multi-db support for Rails applications. In affected versions this vulnerability impacts any Rails applications using `rails_multisite…
CVE-2021-3818Medium5.32021-09-27grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking
CVE-2021-33842High8.82021-06-09Improper Authentication vulnerability in the cookie parameter of Circutor SGE-PLC1000 firmware version 0.9.2b allows an attacker to perform operations as an au…
CVE-2021-29624Medium6.52021-05-19fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "doubl…
CVE-2021-28171Critical9.82021-04-06The Vangene deltaFlow E-platform does not take properly protective measures. Attackers can obtain privileged permissions remotely by tampering with users’ data…
CVE-2020-29668Low3.72020-12-10Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie…
CVE-2020-26955Medium6.52020-12-09When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operation on the same do…
CVE-2020-4749Medium4.32020-10-20IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie…
CVE-2020-7070Medium4.32020-10-02In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-dec…
CVE-2019-4688Medium4.32020-08-26IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get…
CVE-2020-15128Medium6.12020-07-31In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of…
CVE-2019-4638Low3.72020-01-28IBM Security Secret Server 10.7 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive…
CVE-2012-5631High8.82019-11-25ipa 3.0 does not properly check server identity before sending credential containing cookies
CVE-2019-4330Medium4.32019-10-29IBM Security Guardium Big Data Intelligence (SonarG) 4.0 does not set the secure attribute for cookies in HTTPS sessions, which could cause the user agent to s…
CVE-2019-17104High7.52019-10-08In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set.
CVE-2019-4305Medium5.32019-09-30IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by the improper setting of a cookie. IBM X-Force…
CVE-2019-7266Critical9.82019-07-02Linear eMerge 50P/5000P devices allow Authentication Bypass.
CVE-2018-20512Critical9.82019-01-03EPON CPE-WiFi devices 2.0.4-X000 are vulnerable to escalation of privileges by sending cooLogin=1, cooUser=admin, and timestamp=-1 cookies.
CVE-2018-19224High7.52018-11-12An issue was discovered in LAOBANCMS 2.0. /admin/login.php allows spoofing of the id and guanliyuan cookies.
CVE-2018-5190Critical9.82018-04-17PicturesPro Photo Cart 6 and 7 before Security-Patch-2018-B allows remote attackers to access arbitrary customer accounts via a modified cookie, related to pc_…
CVE-2018-5455Critical9.82018-03-05A Reliance on Cookies without Validation and Integrity Checking issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The…
CVE-2017-8034Medium6.62017-07-17The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions…
CVE-2017-7279Critical9.82017-04-12An unprivileged user of the Unitrends Enterprise Backup before 9.0.0 web server can escalate to root privileges by modifying the "token" cookie issued at login.
CVE-2017-6896High8.82017-03-14Privilege escalation vulnerability on the DIGISOL DG-HR1400 1.00.02 wireless router enables an attacker to escalate from user privilege to admin privilege just…
CVE-2011-38872011-10-25Google Chrome before 15.0.874.102 does not properly handle javascript: URLs, which allows remote attackers to bypass intended access restrictions and read cook…
CVE-2008-5784Critical9.82008-12-31V3 Chat - Profiles/Dating Script 3.0.2 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to 1.