CWE-784: Reliance on Cookies without Validation and Integrity Checking in a Security Decision
The product uses a protection mechanism that relies on the existence or values of a cookie, but it does not properly ensure that the cookie is valid for the associated user.
Last updated
Overview
Attackers can easily modify cookies, within the browser or by implementing the client-side code outside of the browser. Attackers can bypass protection mechanisms such as authorization and authentication by modifying the cookie to contain an expected value.
Real-world CVEs
5 recorded CVEs are caused by CWE-784 (Reliance on Cookies without Validation and Integrity Checking in a Security Decision). The highest-severity and most recent are shown first. 1 new CWE-784 CVE has been recorded so far in 2026.
- CVE-2023-3050
Authentication Bypass in TMT's Lockcell
Critical · CVSS 9.8 · EPSS 69th2023-06-13 - CVE-2026-60134
Weintek cMT3092X Reliance on Cookies without Validation and Integrity Checking in a Security Decision
High · CVSS 8.7 · EPSS 25th2026-07-24 - CVE-2024-9820
WP 2FA with Telegram <= 3.0 - Two-Factor Authentication Bypass