CWE-346
Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
We have discovered 40,919 live websites that are affected by CWE-346.
CVEs
- Count - 21
CWE References
Website Distribution by Country
Number of websites using CWE-346 United States | 18,408 websites |
 Germany | 3,169 websites |
 China | 2,052 websites |
 France | 1,587 websites |
 Russia | 1,149 websites |
 Japan | 1,093 websites |
 GB | 1,076 websites |
 Brazil | 1,020 websites |
 Italy | 885 websites |
 Netherlands | 646 websites |
Website Distribution by TLD
Number of websites using CWE-346| .com | 18,623 websites |
| .de | 1,815 websites |
| .org | 1,746 websites |
| .net | 1,091 websites |
| .ru | 947 websites |
| .com.br | 891 websites |
| .it | 793 websites |
| .co.uk | 778 websites |
| .fr | 707 websites |
| .nl | 580 websites |
Newest CVEs
List of the most recent CVEs that are part of CWE-346| Discovered | CVE | Description | Websites |
|---|---|---|---|
| Sep, 2026 | CVE-2026-91132 | Discourse: Wildcard iframe origin allowlist bypass via authority separators | 3,128 |
| Sep, 2026 | CVE-2026-85682 | YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route | 3,036 |
| Sep, 2026 | CVE-2026-12284 | Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler | 33 |
| Sep, 2026 | CVE-2026-75025 | Mattermost Desktop local network access from server-rendered content | 33 |
| Aug, 2026 | CVE-2026-19418 | TYPO3 CMS - Broken Access Control in Backend and Install Tool | 1 |
| Jun, 2026 | CVE-2026-55487 | pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle | 1 |
| Jun, 2026 | CVE-2026-50168 | Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass | 16,611 |
| Jun, 2026 | CVE-2026-47265 | AIOHTTP vulnerable to cross-origin redirect with per-request cookies | 269 |
| May, 2026 | CVE-2026-6339 | Missing request origin validation on burn-on-read reveal endpoint | 30 |
| Mar, 2026 | CVE-2026-2457 | WebSocket Message Spoofing via Permalink Embed Manipulation | 67 |
The most widespread CVEs
List of the most common CVEs that are part of CWE-346| Discovered | CVE | Description | Websites |
|---|---|---|---|
| Jun, 2026 | CVE-2026-50168 | Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass | 16,611 |
| Jan, 2025 | CVE-2024-57965 | In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an ... | 16,531 |
| Sep, 2026 | CVE-2026-91132 | Discourse: Wildcard iframe origin allowlist bypass via authority separators | 3,128 |
| Sep, 2026 | CVE-2026-85682 | YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route | 3,036 |
| Jan, 2025 | CVE-2025-24010 | Vite allows any websites to send any requests to the development server and read the response | 883 |
| Feb, 2025 | CVE-2024-55948 | Anonymous cache poisoning via XHR requests in Discourse | 861 |
| Feb, 2025 | CVE-2025-23023 | Anonymous cache poisoning via request headers in Discourse | 861 |
| Jan, 2026 | CVE-2026-22030 | React Router has CSRF issue in Action/Server Action Request Processing | 269 |
| Jun, 2026 | CVE-2026-47265 | AIOHTTP vulnerable to cross-origin redirect with per-request cookies | 269 |
| Mar, 2026 | CVE-2026-2457 | WebSocket Message Spoofing via Permalink Embed Manipulation | 67 |
Websites affected by CWE-346
Top websites that are affected by CWE-346. Please click on the "Contact us" link to get more information.| Domain | Country | Rank | Contacts |
|---|---|---|---|
| *****.com | United States | ** | |
| ************.com | United States | *,*** | |
| *********.com | United States | *,*** | |
| *************.net | United States | *,*** | |
| ***.************.ca |  Canada | *,*** | |
| *********.com | United States | *,*** | |
| ***.fr | France | *,*** | |
| ********.com | United States | *,*** | |
| ******.*****.com |  Luxembourg | *,*** | |
| ******.ru | Russia | *,*** |