CWE-1270 Generation of Incorrect Security Tokens
baseThe product implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens generated in the system are incorrect.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (11)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-19636US | — | — | ||
An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by i… | ||||
| CVE-2026-15831US | — | — | ||
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated… | ||||
| CVE-2026-54593US | — | — | ||
Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-si… | ||||
| CVE-2026-49499US | — | — | ||
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) a Generation of Incorrect Security Tokens vulnerability in the IAM. A low privileged attacker with remote acc… | ||||
| CVE-2025-59698US | — | — | ||
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), might allow a physically proximate attacker to gain a… | ||||
| CVE-2023-32188US | — | — | ||
A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVe… | ||||
| CVE-2023-22644US | medium5.5 | — | ||
A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVe… | ||||
| CVE-2023-2882US | — | — | ||
Generation of Incorrect Security Tokens vulnerability in CBOT Chatbot allows Token Impersonation, Privilege Abuse.
This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.… | ||||
| CVE-2023-30524US | medium4.3 | — | ||
Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the potential for attackers to observe and cap… | ||||
| CVE-2022-31122US | high8.1 | — | ||
Wire is an encrypted communication and collaboration platform. Versions prior to 2022-07-12/Chart 4.19.0 are subject to Token Recipient Confusion. If an attacker has certain detail… | ||||
| CVE-2014-2237US | medium5.0 | — | ||
The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with imper… | ||||
03
attack patterns (3)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan