Variant weakness
The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order, leading to resultant weaknesses.
Last updated
While this weakness might be caught by the compiler in some languages, it can occur more frequently in cases in which the called function accepts variable numbers or types of arguments, such as format strings in C. It also can occur in languages or environments that do not enforce strong typing.
5 recorded CVEs are caused by CWE-683 (Function Call With Incorrect Order of Arguments). The highest-severity and most recent are shown first. 2 new CWE-683 CVEs have been recorded so far in 2026 (1 in 2025).
Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls
Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint
malcontent's archive extraction could write outside extraction directory
Awesome Support < 6.1.5 - Insufficient permission check in wpas_edit_reply
Flask uses fallback key instead of current signing key
What can happen when CWE-683 is exploited.
Quality Degradation
Affects: Other
Typically introduced during these phases of the software lifecycle.
Practical mitigations for CWE-683, grouped by where in the lifecycle they apply.
Use the function, procedure, or routine as specified.
Because this function call often produces incorrect behavior, it will usually be detected during testing or normal operation of the product.
Exercising all possible control paths will typically expose this weakness, except in rare cases when the incorrect function call accidentally produces the correct results, or if the provided argument type is very similar to the expected argument type.
MITRE examples of the weakness in code.
The following PHP method authenticates a user given a username/password combination but is called with the parameters in reverse order.
Vulnerable example
function authenticate($username, $password) {Real CVEs that MITRE cites as examples of this weakness.
Common questions about CWE-683.
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Get an alert when a new CWE-683 CVE affects your products, with AI-written analysis and remediation steps.