CWE-394
AllowedUnexpected Status Code or Return Value
Abstraction: Base · Status: Draft
The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.
31 vulnerabilities reference this CWE, most recent first.
GHSA-7R87-CJ48-WJ45
Vulnerability from github – Published: 2022-04-26 21:19 – Updated: 2024-09-20 21:03Impact
flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session.
The captcha.validate() function would return None if passed no value (e.g. by submitting a request with an empty form).
If implementing users were checking the return value to be False, the captcha verification check could be bypassed.
Sample vulnerable code:
if captcha.validate() == False:
... # abort
else:
... # do stuff
Patches
A new version (1.2.1) is available that fixes the issue.
Workarounds
Users can workaround the issue by not explicitly checking that the value is False.
Checking the return value less explicitly should still work.
if not captcha.validate():
... # abort
else:
... # do stuff
if captcha.validate():
... # do stuff
else:
... # abort
References
https://github.com/Tethik/flask-session-captcha/pull/27
For more information
If you have any questions or comments about this advisory: * Open an issue in the github repo
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "flask-session-captcha"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-24880"
],
"database_specific": {
"cwe_ids": [
"CWE-253",
"CWE-394",
"CWE-754"
],
"github_reviewed": true,
"github_reviewed_at": "2022-04-26T21:19:52Z",
"nvd_published_at": "2022-04-25T22:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\nflask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session.\n\nThe `captcha.validate()` function would return `None` if passed no value (e.g. by submitting a request with an empty form).\n\nIf implementing users were checking the return value to be **False**, the captcha verification check could be bypassed.\n\nSample vulnerable code:\n```python\nif captcha.validate() == False:\n ... # abort\nelse:\n ... # do stuff\n```\n\n### Patches\nA new version (1.2.1) is available that fixes the issue.\n\n### Workarounds\nUsers can workaround the issue by not explicitly checking that the value is False. \n\nChecking the return value less explicitly should still work. \n\n```python\nif not captcha.validate():\n ... # abort\nelse:\n ... # do stuff\n```\n\n```python\nif captcha.validate():\n ... # do stuff\nelse:\n ... # abort\n```\n\n### References\nhttps://github.com/Tethik/flask-session-captcha/pull/27\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the github repo](https://github.com/Tethik/flask-session-captcha)\n",
"id": "GHSA-7r87-cj48-wj45",
"modified": "2024-09-20T21:03:06Z",
"published": "2022-04-26T21:19:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Tethik/flask-session-captcha/security/advisories/GHSA-7r87-cj48-wj45"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24880"
},
{
"type": "WEB",
"url": "https://github.com/Tethik/flask-session-captcha/pull/27"
},
{
"type": "WEB",
"url": "https://github.com/Tethik/flask-session-captcha/commit/2811ae23a38d33b620fb7a07de8837c6d65c13e4"
},
{
"type": "PACKAGE",
"url": "https://github.com/Tethik/flask-session-captcha"
},
{
"type": "WEB",
"url": "https://github.com/Tethik/flask-session-captcha/releases/tag/v1.2.1"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/flask-session-captcha/PYSEC-2022-193.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Potential Captcha Validate Bypass in flask-session-captcha"
}
GHSA-CRC8-R3C8-83VW
Vulnerability from github – Published: 2026-09-24 15:31 – Updated: 2026-09-24 15:31In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.
{
"affected": [],
"aliases": [
"CVE-2026-73064"
],
"database_specific": {
"cwe_ids": [
"CWE-394"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-24T15:17:34Z",
"severity": "LOW"
},
"details": "In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.",
"id": "GHSA-crc8-r3c8-83vw",
"modified": "2026-09-24T15:31:34Z",
"published": "2026-09-24T15:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73064"
},
{
"type": "WEB",
"url": "https://github.com/Mbed-TLS/mbedtls"
},
{
"type": "WEB",
"url": "https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-random-generator-fault-tls-integrity"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-G6MR-MVF4-4WVJ
Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2024-01-23 15:30A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affecting QueryPlanner. This issue affects: MongoDB Inc. MongoDB Server v3.6 versions prior to 3.6.9, v4.0 versions prior to 4.0.3.
{
"affected": [],
"aliases": [
"CVE-2018-20802"
],
"database_specific": {
"cwe_ids": [
"CWE-394"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-23T16:15:00Z",
"severity": "MODERATE"
},
"details": "A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affecting QueryPlanner. This issue affects: MongoDB Inc. MongoDB Server v3.6 versions prior to 3.6.9, v4.0 versions prior to 4.0.3.",
"id": "GHSA-g6mr-mvf4-4wvj",
"modified": "2024-01-23T15:30:55Z",
"published": "2022-05-24T17:34:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20802"
},
{
"type": "WEB",
"url": "https://jira.mongodb.org/browse/SERVER-36993"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G88Q-58F2-QH8W
Vulnerability from github – Published: 2025-10-30 18:31 – Updated: 2025-11-10 15:31Systemic Internal Server Errors - HTTP 500 ResponseThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
{
"affected": [],
"aliases": [
"CVE-2025-12515"
],
"database_specific": {
"cwe_ids": [
"CWE-394"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-30T16:15:34Z",
"severity": "CRITICAL"
},
"details": "Systemic Internal Server Errors - HTTP 500 ResponseThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .",
"id": "GHSA-g88q-58f2-qh8w",
"modified": "2025-11-10T15:31:03Z",
"published": "2025-10-30T18:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12515"
},
{
"type": "WEB",
"url": "https://azure-access.com/security-advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GVW8-8FQ4-QMW5
Vulnerability from github – Published: 2023-04-18 00:32 – Updated: 2024-04-04 03:31An Unexpected Status Code or Return Value vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated attacker with physical access to the device to cause a Denial of Service (DoS). When certain USB devices are connected to a USB port of the routing-engine (RE), the kernel will crash leading to a reboot of the device. The device will continue to crash as long as the USB device is connected. This issue affects Juniper Networks Junos OS: All versions prior to 19.4R3-S10; 20.2 versions prior to 20.2R3-S7; 20.3 versions prior to 20.3R3-S6; 20.4 versions prior to 20.4R3-S5; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3-S4; 21.3 versions prior to 21.3R3-S3; 21.4 versions prior to 21.4R3-S2; 22.1 versions prior to 22.1R2-S2, 22.1R3; 22.2 versions prior to 22.2R2, 22.2R3; 22.3 versions prior to 22.3R1-S1, 22.3R2; 22.4 versions prior to 22.4R2.
{
"affected": [],
"aliases": [
"CVE-2023-28975"
],
"database_specific": {
"cwe_ids": [
"CWE-394",
"CWE-754"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-17T22:15:09Z",
"severity": "MODERATE"
},
"details": "An Unexpected Status Code or Return Value vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated attacker with physical access to the device to cause a Denial of Service (DoS). When certain USB devices are connected to a USB port of the routing-engine (RE), the kernel will crash leading to a reboot of the device. The device will continue to crash as long as the USB device is connected. This issue affects Juniper Networks Junos OS: All versions prior to 19.4R3-S10; 20.2 versions prior to 20.2R3-S7; 20.3 versions prior to 20.3R3-S6; 20.4 versions prior to 20.4R3-S5; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3-S4; 21.3 versions prior to 21.3R3-S3; 21.4 versions prior to 21.4R3-S2; 22.1 versions prior to 22.1R2-S2, 22.1R3; 22.2 versions prior to 22.2R2, 22.2R3; 22.3 versions prior to 22.3R1-S1, 22.3R2; 22.4 versions prior to 22.4R2.",
"id": "GHSA-gvw8-8fq4-qmw5",
"modified": "2024-04-04T03:31:39Z",
"published": "2023-04-18T00:32:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28975"
},
{
"type": "WEB",
"url": "https://supportportal.juniper.net/JSA70600"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H5C6-JHVM-H7P4
Vulnerability from github – Published: 2025-11-24 21:31 – Updated: 2025-11-24 21:31Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availability.
{
"affected": [],
"aliases": [
"CVE-2025-48510"
],
"database_specific": {
"cwe_ids": [
"CWE-394"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-24T21:16:03Z",
"severity": "HIGH"
},
"details": "Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availability.",
"id": "GHSA-h5c6-jhvm-h7p4",
"modified": "2025-11-24T21:31:00Z",
"published": "2025-11-24T21:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48510"
},
{
"type": "WEB",
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-9019.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HF2C-2HX8-M89F
Vulnerability from github – Published: 2023-12-12 12:30 – Updated: 2023-12-12 12:30A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The Web UI of affected devices does not check the length of parameters in certain conditions. This allows a malicious admin to crash the server by sending a crafted request to the server. The server will automatically restart.
{
"affected": [],
"aliases": [
"CVE-2023-48429"
],
"database_specific": {
"cwe_ids": [
"CWE-394",
"CWE-754"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-12T12:15:15Z",
"severity": "LOW"
},
"details": "A vulnerability has been identified in SINEC INS (All versions \u003c V1.0 SP2 Update 2). The Web UI of affected devices does not check the length of parameters in certain conditions. This allows a malicious admin to crash the server by sending a crafted request to the server. The server will automatically restart.",
"id": "GHSA-hf2c-2hx8-m89f",
"modified": "2023-12-12T12:30:54Z",
"published": "2023-12-12T12:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48429"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-077170.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-MPRQ-MG66-VM32
Vulnerability from github – Published: 2026-02-27 03:30 – Updated: 2026-02-27 03:30A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in which an unexpected return value from the authentication routine is later on processed as a legitimate value, resulting in an authentication bypass.
{
"affected": [],
"aliases": [
"CVE-2026-25085"
],
"database_specific": {
"cwe_ids": [
"CWE-394"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-27T01:16:19Z",
"severity": "HIGH"
},
"details": "A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in\n which an unexpected return value from the authentication routine is \nlater on processed as a legitimate value, resulting in an authentication\n bypass.",
"id": "GHSA-mprq-mg66-vm32",
"modified": "2026-02-27T03:30:26Z",
"published": "2026-02-27T03:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25085"
},
{
"type": "WEB",
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json"
},
{
"type": "WEB",
"url": "https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-P8Q7-X4RW-5V8M
Vulnerability from github – Published: 2025-06-15 15:30 – Updated: 2025-06-15 15:30Improper handling of non-200 http responses in the PingFederate Google Adapter leads to thread exhaustion under normal usage conditions.
{
"affected": [],
"aliases": [
"CVE-2025-22854"
],
"database_specific": {
"cwe_ids": [
"CWE-394"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-15T15:15:19Z",
"severity": "MODERATE"
},
"details": "Improper handling of non-200 http responses in\u00a0the PingFederate Google Adapter\u00a0leads to thread exhaustion under normal usage conditions.",
"id": "GHSA-p8q7-x4rw-5v8m",
"modified": "2025-06-15T15:30:31Z",
"published": "2025-06-15T15:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22854"
},
{
"type": "WEB",
"url": "https://docs.pingidentity.com/integrations/google/google_login_integration_kit/pf_google_cic_changelog.html"
},
{
"type": "WEB",
"url": "https://www.pingidentity.com/en/resources/downloads/pingfederate.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:A/V:X/RE:M/U:Red",
"type": "CVSS_V4"
}
]
}
GHSA-WWR4-CJ7G-985F
Vulnerability from github – Published: 2025-01-15 06:30 – Updated: 2025-02-03 12:30In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be deployed to support authentication using a YubiKey or other FIDO compliant authenticators on macOS or Linux. This software package has an issue that allows for an authentication bypass in some configurations. An attacker would require the ability to access the system as an unprivileged user. Depending on the configuration, the attacker may also need to know the user's password.
{
"affected": [],
"aliases": [
"CVE-2025-23013"
],
"database_specific": {
"cwe_ids": [
"CWE-394"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-15T04:15:20Z",
"severity": "HIGH"
},
"details": "In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be deployed to support authentication using a YubiKey or other FIDO compliant authenticators on macOS or Linux. This software package has an issue that allows for an authentication bypass in some configurations. An attacker would require the ability to access the system as an unprivileged user. Depending on the configuration, the attacker may also need to know the user\u0027s password.",
"id": "GHSA-wwr4-cj7g-985f",
"modified": "2025-02-03T12:30:59Z",
"published": "2025-01-15T06:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23013"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00001.html"
},
{
"type": "WEB",
"url": "https://www.yubico.com/support/security-advisories/ysa-2025-01"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/01/15/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/01/16/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/01/16/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/01/16/4"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/01/16/5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.