The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

Attackers might be able to spoof the intended endpoint from a different system or process, thus gaining the same level of access as the intended endpoint.
While this issue frequently involves authentication between network-based clients and servers, other types of communication channels and endpoints can have this weakness.

Primary

Resultant

Architecture and Design
REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Integrity
Confidentiality
Gain Privileges or Assume Identity
If an attacker can spoof the endpoint, the attacker gains all the privileges that were intended for the original endpoint.

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
High

These cross-domain policy files mean to allow Flash and Silverlight applications hosted on other domains to access its data:
Flash crossdomain.xml :

<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd"><allow-access-from domain="*.example.com"/><allow-access-from domain="*"/></cross-domain-policy>

Silverlight clientaccesspolicy.xml :

<?xml version="1.0" encoding="utf-8"?><access-policy><cross-domain-access><policy><allow-from http-request-headers="SOAPAction"><domain uri="*"/></allow-from><grant-to><resource path="/" include-subpaths="true"/></grant-to></policy></cross-domain-access></access-policy>

These entries are far too permissive, allowing any Flash or Silverlight application to send requests. A malicious application hosted on any other web site will be able to send requests on behalf of any user tricked into executing it.

This Android application will remove a user account when it receives an intent to do so:

IntentFilter filter = new IntentFilter("com.example.RemoveUser");MyReceiver receiver = new MyReceiver();registerReceiver(receiver, filter);
public class DeleteReceiver extends BroadcastReceiver {@Overridepublic void onReceive(Context context, Intent intent) {int userID = intent.getIntExtra("userID");destroyUserData(userID);}}

This application does not check the origin of the intent, thus allowing any malicious application to remove a user. Always check the origin of an intent, or create an allowlist of trusted applications using the manifest.xml file.

CVE-2022-30319
S-bus functionality in a home automation product performs access control using an IP allowlist, which can be bypassed by a forged IP address.
https://www.cve.org/CVERecord?id=CVE-2022-30319

CVE-2022-22547
A troubleshooting tool exposes a web server on a random port between 9000-65535 that could be used for information gathering
https://www.cve.org/CVERecord?id=CVE-2022-22547

CVE-2022-4390
A WAN interface on a router has firewall restrictions enabled for IPv4, but it does not for IPv6, which is enabled by default
https://www.cve.org/CVERecord?id=CVE-2022-4390

CVE-2012-2292
Product has a Silverlight cross-domain policy that does not restrict access to another application, which allows remote attackers to bypass the Same Origin Policy.
https://www.cve.org/CVERecord?id=CVE-2012-2292

CVE-2012-5810
Mobile banking application does not verify hostname, leading to financial loss.
https://www.cve.org/CVERecord?id=CVE-2012-5810

CVE-2014-1266
Chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) -> CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint). The code's whitespace indentation did not reflect the actual control flow (CWE-1114) and did not explicitly delimit the block (CWE-483), which could have made it more difficult for human code auditors to detect the vulnerability.
https://www.cve.org/CVERecord?id=CVE-2014-1266

CVE-2000-1218
DNS server can accept DNS updates from hosts that it did not query, leading to cache poisoning
https://www.cve.org/CVERecord?id=CVE-2000-1218

Allowed-with-Review
This CWE entry is a Class and might have Base-level children that would be more appropriate
Examine children of this entry to see if there is a better fit

CWE Content Team
MITRE
2013-06-23
2.5
2013-07-17

CWE Content Team
MITRE
2014-02-18
updated Description, Name, Relationships

CWE Content Team
MITRE
2017-11-08
updated Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2019-01-03
updated Related_Attack_Patterns

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2021-03-15
updated Maintenance_Notes

CWE Content Team
MITRE
2022-10-13
updated Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2023-01-31
updated Description, Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2023-04-27
updated Detection_Factors, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Observed_Examples

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Demonstrative_Examples

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Observed_Examples, Weakness_Ordinalities

Improper Authentication of Endpoint in a Communication Channel