cve.bz

CWE-784: Reliance on Cookies without Validation and Integrity Checking in a Security Decision

Filter

The product uses a protection mechanism that relies on the existence or values of a cookie, but it does not properly ensure that the cookie is valid for the associated user.

What the weakness is: CWE-784 at MITRE. OWASP Top 10: A08:2025 Software or Data Integrity Failures

Ask an AI about CWE-784

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-784: Reliance on Cookies without Validation and Integrity Checking in a Security Decision and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/784.html and https://cve.bz/cve/cwe/784?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.7CVE-2026-60134EPSS 0.6%

    Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges.

  2. 8.1CVE-2026-45055EPSS 0.1%

    CubeCart is an ecommerce software solution. Prior to 6.7.2, CubeCart 6.6.x – 6.7.1 builds CC_STORE_URL directly from the Host request header at bootstrap, with no allowlist. The constant is embedded verbatim into transactional email links,…

  3. 7.5CVE-2024-9820EPSS 0.4%

    The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This is due to the two-factor code being stored in a cookie, which makes it possible to bypass two-facto…

  4. 9.8CVE-2023-3050EPSS 1.3%

    Reliance on Cookies without Validation and Integrity Checking in a Security Decision vulnerability in TMT Lockcell allows Privilege Abuse, Authentication Bypass. This issue affects Lockcell: before 15.

  5. 5.4CVE-2022-3083EPSS 0.4%

    All versions of Landis+Gyr E850 (ZMQ200) are vulnerable to CWE-784: Reliance on Cookies Without Validation and Integrity. The device's web application navigation depends on the value of the session cookie. The web application could become …

  6. 7.5CVE-2020-8184EPSS 3.0%

    A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.