The product does not properly verify that the source of data or communication is valid.

Primary

Resultant

Architecture and Design

Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Access Control
Other
Gain Privileges or Assume Identity
Varies by Context
An attacker can access any functionality that is inadvertently accessible to the source.

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

This Android application will remove a user account when it receives an intent to do so:

IntentFilter filter = new IntentFilter("com.example.RemoveUser");MyReceiver receiver = new MyReceiver();registerReceiver(receiver, filter);
public class DeleteReceiver extends BroadcastReceiver {@Overridepublic void onReceive(Context context, Intent intent) {int userID = intent.getIntExtra("userID");destroyUserData(userID);}}

This application does not check the origin of the intent, thus allowing any malicious application to remove a user. Always check the origin of an intent, or create an allowlist of trusted applications using the manifest.xml file.

These Android and iOS applications intercept URL loading within a WebView and perform special actions if a particular URL scheme is used, thus allowing the Javascript within the WebView to communicate with the application:

// Android
@Overridepublic boolean shouldOverrideUrlLoading(WebView view, String url){
if (url.substring(0,14).equalsIgnoreCase("examplescheme:")){if(url.substring(14,25).equalsIgnoreCase("getUserInfo")){writeDataToView(view, UserData);return false;}else{return true;}}
}

// iOS
-(BOOL) webView:(UIWebView *)exWebView shouldStartLoadWithRequest:(NSURLRequest *)exRequest navigationType:(UIWebViewNavigationType)exNavigationType{
NSURL *URL = [exRequest URL];if ([[URL scheme] isEqualToString:@"exampleScheme"]){
NSString *functionString = [URL resourceSpecifier];if ([functionString hasPrefix:@"specialFunction"]){

// Make data available back in webview.
UIWebView *webView = [self writeDataToView:[URL query]];
}return NO;
}return YES;
}

A call into native code can then be initiated by passing parameters within the URL:

window.location = examplescheme://method?parameter=value

Because the application does not check the source, a malicious website loaded within this WebView has the same access to the API as a trusted site.

CVE-2000-1218
DNS server can accept DNS updates from hosts that it did not query, leading to cache poisoning
https://www.cve.org/CVERecord?id=CVE-2000-1218

CVE-2018-6074
Browser does not set Mark-of-the-Web (MotW) for a downloaded .EXE file if the name is close to the maximum path length, preventing recording of a zone identifier in the filename
https://www.cve.org/CVERecord?id=CVE-2018-6074

CVE-2025-0411
Zip file extraction program does not propagate Mark-of-the-Web (MotW) metadata to files that are extracted from an Internet-downloaded Zip file
https://www.cve.org/CVERecord?id=CVE-2025-0411

CVE-2025-46652
Zip file extraction program does not propagate Mark-of-the-Web (MotW) metadata to files that are extracted from an Internet-downloaded Zip file
https://www.cve.org/CVERecord?id=CVE-2025-46652

CVE-2005-0877
DNS server can accept DNS updates from hosts that it did not query, leading to cache poisoning
https://www.cve.org/CVERecord?id=CVE-2005-0877

CVE-2001-1452
DNS server caches glue records received from non-delegated name servers
https://www.cve.org/CVERecord?id=CVE-2001-1452

CVE-2005-2188
user ID obtained from untrusted source (URL)
https://www.cve.org/CVERecord?id=CVE-2005-2188

CVE-2003-0174
LDAP service does not verify if a particular attribute was set by the LDAP server
https://www.cve.org/CVERecord?id=CVE-2003-0174

CVE-1999-1549
product does not sufficiently distinguish external HTML from internal, potentially dangerous HTML, allowing bypass using special strings in the page title. Overlaps special elements.
https://www.cve.org/CVERecord?id=CVE-1999-1549

CVE-2003-0981
product records the reverse DNS name of a visitor in the logs, allowing spoofing and resultant XSS.
https://www.cve.org/CVERecord?id=CVE-2003-0981

Origin Validation Error

Part 3-3
Req SR 2.12 RE(1)

Part 4-1
Req SD-1

Part 4-1
Req SR-2

Part 4-1
Req SVV-1

Part 4-2
Req CR 2.12 RE(1)

Part 4-2
Req CR 3.1 RE(1)

Allowed-with-Review
This CWE entry is a Class and might have Base-level children that would be more appropriate
Examine children of this entry to see if there is a better fit

This entry has some significant overlap with other CWE entries and may need some clarification. See terminology notes.
The "Origin Validation Error" term was originally used in a 1995 thesis [REF-324]. Although not formally defined, an issue is considered to be an origin validation error if either (1) "an object [accepts] input from an unauthorized subject," or (2) "the system [fails] to properly or completely authenticate a subject." A later section says that an origin validation error can occur when the system (1) "does not properly authenticate a user or process" or (2) "does not properly authenticate the shared data or libraries." The only example provided in the thesis (covered by OSVDB:57615) involves a setuid program running command-line arguments without dropping privileges. So, this definition (and its examples in the thesis) effectively cover other weaknesses such as CWE-287 (Improper Authentication), CWE-285 (Improper Authorization), and CWE-250 (Execution with Unnecessary Privileges). There appears to be little usage of this term today, except in the SecurityFocus vulnerability database, where the term is used for a variety of issues, including web-browser problems that allow violation of the Same Origin Policy and improper validation of the source of an incoming message.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Relationship_Notes, Taxonomy_Mappings, Weakness_Ordinalities

CWE Content Team
MITRE
2009-05-27
updated Related_Attack_Patterns

CWE Content Team
MITRE
2010-12-13
updated Related_Attack_Patterns

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2014-02-18
updated Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Maintenance_Notes, References, Relationship_Notes, Relationships, Terminology_Notes

CWE Content Team
MITRE
2014-06-23
updated Related_Attack_Patterns

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Modes_of_Introduction, References, Relationships

CWE Content Team
MITRE
2019-06-20
updated Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2020-06-25
updated Demonstrative_Examples, Terminology_Notes

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2022-04-28
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description, Type

CWE Content Team
MITRE
2023-04-27
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes, Relationships

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Taxonomy_Mappings

CWE Content Team
MITRE
2024-11-19
4.16
2024-11-19
updated References

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated Observed_Examples

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Detection_Factors, Relationships

"Mapping CWE to 62443" Sub-Working Group
CWE-CAPEC ICS/OT SIG
2023-04-25
Suggested mappings to ISA/IEC 62443.