cve.bz

CWE-1270: Generation of Incorrect Security Tokens

Filter

The product implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens generated in the system are incorrect.

What the weakness is: CWE-1270 at MITRE. All weaknesses

Related attack patterns (CAPEC): 3
  • CAPEC-121 Exploit Non-Production Interfaces Likelihood: Low · Severity: High
  • CAPEC-633 Token Impersonation Severity: Medium
  • CAPEC-681 Exploitation of Improperly Controlled Hardware Security Identifiers Likelihood: Medium · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-1270, as MITRE names them. Credits.

Ask an AI about CWE-1270

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-1270: Generation of Incorrect Security Tokens and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1270.html and https://cve.bz/cve/cwe/1270?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.0CVE-2026-19636EPSS 0.3%

    An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation.

  2. 4.3CVE-2026-15831EPSS 0.3%

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to bypass administrator-configured tool governance pol…

  3. 8.1CVE-2026-54593EPSS 0.7%

    Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained server_uuid, user_uuid, and unique_…

  4. 8.8CVE-2026-49499EPSS 0.4%

    Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) a Generation of Incorrect Security Tokens vulnerability in the IAM. A low privileged attacker with remote access could potentially exploit this vulnerability, leading t…

  5. 6.8CVE-2025-59698EPSS 0.4%

    Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), might allow a physically proximate attacker to gain access to the EOL legacy bootloader.

  6. 9.4CVE-2023-32188EPSS 0.6%

    A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.

  7. 9.4CVE-2023-22644EPSS 0.5%

    A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.

  8. 9.8CVE-2023-2882EPSS 0.6%

    Generation of Incorrect Security Tokens vulnerability in CBOT Chatbot allows Token Impersonation, Privilege Abuse. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

  9. 4.3CVE-2023-30524EPSS 0.4%

    Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the potential for attackers to observe and capture them.

  10. 8.1CVE-2022-31122EPSS 0.7%

    Wire is an encrypted communication and collaboration platform. Versions prior to 2022-07-12/Chart 4.19.0 are subject to Token Recipient Confusion. If an attacker has certain details of SAML IdP metadata, and configures their own SAML on th…