The product does not properly verify that the source of data or communication is valid.
View on MITREAn attacker can access any functionality that is inadvertently accessible to the source.
No mitigation information available for this CWE.
No detection method information available for this CWE.
This Android application will remove a user account when it receives an intent to do so:
This application does not check the origin of the intent, thus allowing any malicious application to remove a user. Always check the origin of an intent, or create an allowlist of trusted applications using the manifest.xml file.
IntentFilter filter = new IntentFilter("com.example.RemoveUser");MyReceiver receiver = new MyReceiver();registerReceiver(receiver, filter); public class DeleteReceiver extends BroadcastReceiver {@Overridepublic void onReceive(Context context, Intent intent) {int userID = intent.getIntExtra("userID");destroyUserData(userID);}}These Android and iOS applications intercept URL loading within a WebView and perform special actions if a particular URL scheme is used, thus allowing the Javascript within the WebView to communicate with the application:
A call into native code can then be initiated by passing parameters within the URL:
// Android @Overridepublic boolean shouldOverrideUrlLoading(WebView view, String url){ if (url.substring(0,14).equalsIgnoreCase("examplescheme:")){if(url.substring(14,25).equalsIgnoreCase("getUserInfo")){writeDataToView(view, UserData);return false;}else{return true;}} }These Android and iOS applications intercept URL loading within a WebView and perform special actions if a particular URL scheme is used, thus allowing the Javascript within the WebView to communicate with the application:
A call into native code can then be initiated by passing parameters within the URL:
// iOS -(BOOL) webView:(UIWebView *)exWebView shouldStartLoadWithRequest:(NSURLRequest *)exRequest navigationType:(UIWebViewNavigationType)exNavigationType{ NSURL *URL = [exRequest URL];if ([[URL scheme] isEqualToString:@"exampleScheme"]){ NSString *functionString = [URL resourceSpecifier];if ([functionString hasPrefix:@"specialFunction"]){ // Make data available back in webview. UIWebView *webView = [self writeDataToView:[URL query]]; }return NO; }return YES; }These Android and iOS applications intercept URL loading within a WebView and perform special actions if a particular URL scheme is used, thus allowing the Javascript within the WebView to communicate with the application:
A call into native code can then be initiated by passing parameters within the URL:
window.location = examplescheme://method?parameter=valueDNS server can accept DNS updates from hosts that it did not query, leading to cache poisoning
View DetailsBrowser does not set Mark-of-the-Web (MotW) for a downloaded .EXE file if the name is close to the maximum path length, preventing recording of a zone identifier in the filename
View DetailsZip file extraction program does not propagate Mark-of-the-Web (MotW) metadata to files that are extracted from an Internet-downloaded Zip file
View DetailsZip file extraction program does not propagate Mark-of-the-Web (MotW) metadata to files that are extracted from an Internet-downloaded Zip file
View DetailsDNS server can accept DNS updates from hosts that it did not query, leading to cache poisoning
View DetailsLDAP service does not verify if a particular attribute was set by the LDAP server
View Detailsproduct does not sufficiently distinguish external HTML from internal, potentially dangerous HTML, allowing bypass using special strings in the page title. Overlaps special elements.
View Detailsproduct records the reverse DNS name of a visitor in the logs, allowing spoofing and resultant XSS.
View DetailsAdditional facts reviewed against primary or authoritative security sources.
Documented detection approaches include Automated Static Analysis; recorded impacts include Gain Privileges or Assume Identity, and Varies by Context; the entry maps to CAPEC-111, CAPEC-141, CAPEC-142, and CAPEC-160. Use these source-defined anchors to turn CWE-346 into implementation, review, and verification checks for the affected component.
CWE-346: Origin Validation Error — MITRE CWEUse NIST SSDF practices to make prevention of CWE-346, Origin Validation Error, an explicit development outcome. Translate the CWE definition into security requirements and design constraints, choose safer implementation patterns and toolchain checks, and define acceptance evidence before release. Feed every confirmed occurrence back into the requirements, design review, and coding rules so the same root cause is removed across the product rather than patched in one location.
NIST SP 800-218 Secure Software Development Framework — National Institute of Standards and TechnologyUse CISA's Known Exploited Vulnerabilities catalog to test whether a vulnerability mapped to CWE-346, Origin Validation Error, has evidence of exploitation in the wild. Confirm the CVE-to-CWE root-cause mapping independently before attaching the example, then capture the affected product, required action, and remediation deadline. A missing KEV match is not evidence that the weakness is unexploited, and a KEV entry must not be generalized to every occurrence of this CWE.
Known Exploited Vulnerabilities Catalog — Cybersecurity and Infrastructure Security AgencyApply MITRE's full root-cause mapping guidance when using CWE-346, Origin Validation Error. Separate weakness language from attacker prerequisites and technical impact, check the entry's abstraction and vulnerability-mapping notes, and prefer the most specific Base or Variant supported by the evidence. Record the rejected alternatives and require an independent review before the mapping is used for remediation trends or program metrics.
CVE to CWE Root Cause Mapping Guidance — MITRE CWEApply MITRE's root-cause mapping quick tips to CWE-346, Origin Validation Error. Confirm the finding describes the causal weakness rather than an impact or attack pattern, compare the abstraction and mapping notes with plausible alternatives, and have a second reviewer challenge the selection. Preserve the evidence and reasoning so recurring defects can be measured against one consistent identifier.
CVE to CWE Root Cause Mapping Quick Tips — MITRE CWECWE-346: Origin Validation Error is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product does not properly verify that the source of data or communication is valid.
If exploited, CWE-346 (Origin Validation Error) it can compromise Access Control and Other, leading to outcomes such as Gain Privileges or Assume Identity and Varies by Context.
CWE-346 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
MITRE documents real CVEs mapped to CWE-346, including CVE-2000-1218, CVE-2018-6074, CVE-2025-0411, CVE-2025-46652 and CVE-2005-0877. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
A CWE (Common Weakness Enumeration) like CWE-346 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.