CWE-683: Function Call With Incorrect Order of Arguments
The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order, leading to resultant weaknesses.
Last updated
Overview
While this weakness might be caught by the compiler in some languages, it can occur more frequently in cases in which the called function accepts variable numbers or types of arguments, such as format strings in C. It also can occur in languages or environments that do not enforce strong typing.
Real-world CVEs
5 recorded CVEs are caused by CWE-683 (Function Call With Incorrect Order of Arguments). The highest-severity and most recent are shown first. 2 new CWE-683 CVEs have been recorded so far in 2026 (1 in 2025).
- CVE-2023-32059High · CVSS 8.7 · EPSS 52th2023-05-11
- CVE-2026-32269
Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint
Medium · CVSS 6.3 · EPSS 20th2026-03-12 - CVE-2026-24846
malcontent's archive extraction could write outside extraction directory
Medium · CVSS 5.5 · EPSS 7th2026-01-29 - CVE-2023-5352
Awesome Support < 6.1.5 - Insufficient permission check in wpas_edit_reply
Medium · CVSS 4.3 · EPSS 34th2023-11-06 - CVE-2025-47278
Flask uses fallback key instead of current signing key
Low · CVSS 1.8 · EPSS 8th2025-05-13
Common consequences
What can happen when CWE-683 is exploited.
Quality Degradation
Affects: Other
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
How to prevent it
Practical mitigations for CWE-683, grouped by where in the lifecycle they apply.
Use the function, procedure, or routine as specified.
How to detect it
Automated Analysis
Because this function call often produces incorrect behavior, it will usually be detected during testing or normal operation of the product.
Automated Analysis
Exercising all possible control paths will typically expose this weakness, except in rare cases when the incorrect function call accidentally produces the correct results, or if the provided argument type is very similar to the expected argument type.
Code examples
Illustrative examples from MITRE showing how the weakness appears in code.
The following PHP method authenticates a user given a username/password combination but is called with the parameters in reverse order.
Vulnerable example
function authenticate($username, $password) {Illustrative examples
Real CVEs that MITRE cites as examples of this weakness.
- CVE-2006-7049 — Application calls functions with arguments in the wrong order, allowing attacker to bypass intended access restrictions.
Frequently asked questions
Common questions about CWE-683.
- What is CWE-683?
- The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order, leading to resultant weaknesses.
- What CVEs are caused by CWE-683?
- 5 recorded CVEs are attributed to CWE-683, including CVE-2023-32059, CVE-2026-32269, CVE-2026-24846.
- How do you prevent CWE-683?
- Use the function, procedure, or routine as specified.
- How is CWE-683 detected?
- Automated Analysis: Because this function call often produces incorrect behavior, it will usually be detected during testing or normal operation of the product.
- What are the consequences of CWE-683?
- Exploiting CWE-683 can lead to: Quality Degradation.
- Is CWE-683 actively exploited?
- 5 recorded CVEs are caused by CWE-683; none are currently in CISA's KEV catalog of actively exploited flaws.
References
- MITRE CWE definition (CWE-683) (opens in a new tab)
- CWE-683 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Stay ahead of CWE-683
Get alerted the moment a new CWE-683 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.