CWE · MITRE source
CWE-807Reliance on Untrusted Inputs in a Security Decision
The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
Developers may assume that inputs such as cookies, environment variables, and hidden form fields cannot be modified. However, an attacker could change these inputs using customized clients or other attacks. This change might not be detected. When security decisions such as authentication and authorization are made based on the values of these inputs, attackers can bypass the security of the software. Without sufficient encryption, integrity checking, or other mechanism, any input that originates from an outsider cannot be trusted.
Last updated: 09 May 2026 03:25 UTC
NIST 800-53 r5 controls that address this weakness (3)AI
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
PT-8 | Computer Matching Requirements | PT | Prevents reliance on untrusted matching results for security-relevant decisions by enforcing verification and contest procedures. |
SC-16 | Transmission of Security and Privacy Attributes | SC | Providing authoritative attributes with the data reduces the need for security decisions to rely on untrusted external inputs. |
SI-9 | Information Input Restrictions | SI | Reduces reliance on untrusted inputs by ensuring only authorized sources may supply data. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2026-21509 KEV | 4.3 | 7.8 | 0.1253 | 2026-01-26 |
CVE-2026-21514 KEV | 3.9 | 7.8 | 0.0539 | 2026-02-10 |
CVE-2023-45128 | 2.0 | 10.0 | 0.0015 | 2023-10-16 |
CVE-2025-49827 | 2.0 | 9.8 | 0.0019 | 2025-07-15 |
CVE-2025-12487 | 2.0 | 9.8 | 0.0144 | 2025-11-06 |
CVE-2025-12488 | 2.0 | 9.8 | 0.0144 | 2025-11-06 |
CVE-2025-66570 | 2.0 | 10.0 | 0.0003 | 2025-12-05 |
CVE-2026-32975 | 2.0 | 9.8 | 0.0008 | 2026-03-29 |
CVE-2025-13926 | 2.0 | 9.8 | 0.0009 | 2026-04-09 |
CVE-2024-29039 | 1.9 | 9.0 | 0.0171 | 2024-06-28 |
CVE-2025-1126 | 1.9 | 9.3 | 0.0004 | 2025-02-11 |
CVE-2021-31999 | 1.8 | 8.8 | 0.0038 | 2021-07-15 |
CVE-2024-28824 | 1.8 | 8.8 | 0.0009 | 2024-03-22 |
CVE-2024-55354 | 1.8 | 8.8 | 0.0008 | 2025-04-08 |
CVE-2026-33068 | 1.8 | 8.8 | 0.0012 | 2026-03-20 |
CVE-2021-41129 | 1.6 | 8.1 | 0.0026 | 2021-10-06 |
CVE-2021-36777 | 1.6 | 8.1 | 0.0031 | 2022-03-09 |
CVE-2023-0009 | 1.6 | 7.8 | 0.0005 | 2023-06-14 |
CVE-2024-28829 | 1.6 | 7.8 | 0.0008 | 2024-08-20 |
CVE-2024-5754 | 1.6 | 8.2 | 0.0005 | 2024-09-13 |
CVE-2024-13974 | 1.6 | 8.1 | 0.0048 | 2025-07-21 |
CVE-2026-25931 | 1.6 | 7.8 | 0.0002 | 2026-02-09 |
CVE-2022-24400 | 1.5 | 7.5 | 0.0016 | 2023-10-19 |
CVE-2024-51561 | 1.5 | 7.5 | 0.0010 | 2024-11-04 |
CVE-2025-59152 | 1.5 | 7.5 | 0.0006 | 2025-10-06 |