CWE · MITRE source
CWE-346Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
Last updated: 09 May 2026 03:25 UTC
NIST 800-53 r5 controls that address this weakness (5)AI
Showing the 4 most specific. Generic controls that address many weakness types are collapsed below.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SC-11 | Trusted Path | SC | Trusted path establishment enforces validation that the communication originates from and reaches only the intended trusted system components. |
SC-20 | Secure Name/Address Resolution Service (Authoritative Source) | SC | Enforces validation of the true origin of DNS responses via signatures and chain-of-trust mechanisms. |
SC-21 | Secure Name/Address Resolution Service (Recursive or Caching Resolver) | SC | Enforces origin validation of name/address data, eliminating reliance on unverified or impersonated DNS sources. |
IA-9 | Service Identification and Authentication | IA | Requires unique identification of the service before communications, addressing failures to validate the origin of the interaction. |
Show 1 more broadly-applicable controls
SC-23 | Session Authenticity | SC | Mandates origin validation so that only legitimate endpoints can continue the authenticated session. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2015-4495 KEV | 8.1 | 8.8 | 0.7157 | 2015-08-08 |
CVE-2020-16952 | 6.2 | 8.6 | 0.7508 | 2020-10-16 |
CVE-2009-1185 | 5.4 | 0.0 | 0.8951 | 2009-04-17 |
CVE-2022-41924 | 5.1 | 9.6 | 0.5356 | 2022-11-23 |
CVE-2019-3980 | 4.9 | 9.8 | 0.4923 | 2019-10-08 |
CVE-2021-26291 | 4.6 | 9.1 | 0.4610 | 2021-04-23 |
CVE-2024-23898 | 4.0 | 8.8 | 0.3687 | 2024-01-24 |
CVE-2021-21135 | 2.8 | 6.5 | 0.2493 | 2021-02-09 |
CVE-2021-21136 | 2.8 | 6.5 | 0.2515 | 2021-02-09 |
CVE-2020-1408 | 2.7 | 8.8 | 0.1587 | 2020-07-14 |
CVE-2025-34291 | 2.6 | 8.8 | 0.1327 | 2025-12-05 |
CVE-2018-15723 | 2.4 | 9.8 | 0.0732 | 2018-12-20 |
CVE-2020-1449 | 2.4 | 7.8 | 0.1477 | 2020-07-14 |
CVE-2019-8069 | 2.2 | 9.8 | 0.0343 | 2019-09-12 |
CVE-2000-1218 | 2.1 | 9.8 | 0.0222 | 2000-04-14 |
CVE-2016-5168 | 2.1 | 7.5 | 0.0963 | 2017-04-21 |
CVE-2019-15020 | 2.1 | 9.8 | 0.0158 | 2019-10-09 |
CVE-2003-0174 | 2.0 | 9.8 | 0.0036 | 2003-05-12 |
CVE-2017-13274 | 2.0 | 9.8 | 0.0006 | 2018-04-04 |
CVE-2018-5116 | 2.0 | 9.8 | 0.0046 | 2018-06-11 |
CVE-2018-5409 | 2.0 | 9.8 | 0.0019 | 2019-05-08 |
CVE-2019-16517 | 2.0 | 9.8 | 0.0022 | 2020-01-23 |
CVE-2019-4640 | 2.0 | 9.8 | 0.0012 | 2020-02-19 |
CVE-2020-26527 | 2.0 | 9.8 | 0.0044 | 2020-10-02 |
CVE-2021-37705 | 2.0 | 10.0 | 0.0047 | 2021-08-13 |