Common Weakness Enumeration
CWE-841
AllowedImproper Enforcement of Behavioral Workflow
Abstraction: Class · Status: Incomplete
The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.
107 vulnerabilities reference this CWE, most recent first.
GHSA-F83J-V8R3-VFHV
Vulnerability from github – Published: 2026-07-28 12:31 – Updated: 2026-07-28 12:31
VLAI
Details
Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-18029"
],
"database_specific": {
"cwe_ids": [
"CWE-841"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-28T11:17:03Z",
"severity": "MODERATE"
},
"details": "Our payment integration with GiroCheckout did not properly validate \npayment status responses. An attacker could use a successful payment \nstatus response from one payment and supply it to the system for a \ndifferent payment, gaining access to multiple valid tickets with only \none payment.",
"id": "GHSA-f83j-v8r3-vfhv",
"modified": "2026-07-28T12:31:20Z",
"published": "2026-07-28T12:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18029"
},
{
"type": "WEB",
"url": "https://pretix.eu/about/en/blog/20260728-release-2026-6-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-F99X-GWVM-JPFM
Vulnerability from github – Published: 2025-10-14 18:30 – Updated: 2025-10-14 18:30
VLAI
Details
Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
Severity
6.1 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-55337"
],
"database_specific": {
"cwe_ids": [
"CWE-841"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-14T17:15:47Z",
"severity": "MODERATE"
},
"details": "Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.",
"id": "GHSA-f99x-gwvm-jpfm",
"modified": "2025-10-14T18:30:30Z",
"published": "2025-10-14T18:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55337"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55337"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FCV9-H6PH-8MRC
Vulnerability from github – Published: 2026-08-26 18:31 – Updated: 2026-08-26 18:31
VLAI
Details
Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint (PATCH /api/teams/{id}), which removes all existing team members before validating the submitted replacement member list. An authenticated teamlead (or other user) with permission to edit a team can submit a malformed members payload; although Kimai returns a validation error, the existing membership rows have already been deleted. This bypasses the dedicated member-removal endpoint's protection against removing teamleaders and can leave a team with no members or teamleaders, disrupting team-based access control.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-80195"
],
"database_specific": {
"cwe_ids": [
"CWE-841"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-26T05:18:26Z",
"severity": "HIGH"
},
"details": "Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint (PATCH /api/teams/{id}), which removes all existing team members before validating the submitted replacement member list. An authenticated teamlead (or other user) with permission to edit a team can submit a malformed members payload; although Kimai returns a validation error, the existing membership rows have already been deleted. This bypasses the dedicated member-removal endpoint\u0027s protection against removing teamleaders and can leave a team with no members or teamleaders, disrupting team-based access control.",
"id": "GHSA-fcv9-h6ph-8mrc",
"modified": "2026-08-26T18:31:52Z",
"published": "2026-08-26T18:31:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/kimai/kimai/security/advisories/GHSA-6rxf-4hh9-pp46"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80195"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/kimai-before-2.63.0-team-membership-removal-via-api"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FGQP-CJ3R-63FM
Vulnerability from github – Published: 2025-10-14 18:30 – Updated: 2025-10-14 18:30
VLAI
Details
Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
Severity
6.1 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-55682"
],
"database_specific": {
"cwe_ids": [
"CWE-841"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-14T17:15:48Z",
"severity": "MODERATE"
},
"details": "Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.",
"id": "GHSA-fgqp-cj3r-63fm",
"modified": "2025-10-14T18:30:31Z",
"published": "2025-10-14T18:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55682"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55682"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FJJX-Q8WJ-9P75
Vulnerability from github – Published: 2022-06-25 00:00 – Updated: 2022-07-07 00:00
VLAI
Details
Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication, including a “root” user level meant only for the vendor. Web server root level access allows for changing of safety critical parameters.
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2022-2105"
],
"database_specific": {
"cwe_ids": [
"CWE-841"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-24T15:15:00Z",
"severity": "CRITICAL"
},
"details": "Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication, including a \u201croot\u201d user level meant only for the vendor. Web server root level access allows for changing of safety critical parameters.",
"id": "GHSA-fjjx-q8wj-9p75",
"modified": "2022-07-07T00:00:27Z",
"published": "2022-06-25T00:00:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2105"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G886-73CF-92QR
Vulnerability from github – Published: 2026-03-16 15:30 – Updated: 2026-03-16 15:30
VLAI
Details
IBM Aspera Console 3.3.0 through 3.4.8 could allow a privileged user to cause a denial of service due to improper enforcement of behavioral workflow.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-13459"
],
"database_specific": {
"cwe_ids": [
"CWE-841"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-16T14:17:54Z",
"severity": "LOW"
},
"details": "IBM Aspera Console 3.3.0 through 3.4.8 could allow a privileged user to cause a denial of service due to improper enforcement of behavioral workflow.",
"id": "GHSA-g886-73cf-92qr",
"modified": "2026-03-16T15:30:41Z",
"published": "2026-03-16T15:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13459"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7263486"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-J72M-JWMC-PQV8
Vulnerability from github – Published: 2023-05-03 12:30 – Updated: 2024-04-04 03:47
VLAI
Details
An Improper Enforcement of Behavioral Workflow vulnerability in the exchangeDeviceServices function on the amzn.dmgr service allowed an attacker to register services that are only locally accessible.
This issue affects:
Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS versions prior to 7.6.3.3.
Severity
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-1383"
],
"database_specific": {
"cwe_ids": [
"CWE-841"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-03T12:16:44Z",
"severity": "MODERATE"
},
"details": "An Improper Enforcement of Behavioral Workflow vulnerability in the exchangeDeviceServices function on the amzn.dmgr service allowed an attacker to register services that are only locally accessible.\n\nThis issue affects:\n\nAmazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. \nInsignia TV with FireOS versions prior to 7.6.3.3.",
"id": "GHSA-j72m-jwmc-pqv8",
"modified": "2024-04-04T03:47:11Z",
"published": "2023-05-03T12:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1383"
},
{
"type": "WEB",
"url": "https://www.bitdefender.com/blog/labs/vulnerabilities-identified-amazon-fire-tv-stick-insignia-fire-os-tv-series"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M44C-8M5V-Q44R
Vulnerability from github – Published: 2025-10-14 18:30 – Updated: 2025-10-14 18:30
VLAI
Details
Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
Severity
6.1 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-55332"
],
"database_specific": {
"cwe_ids": [
"CWE-841"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-14T17:15:46Z",
"severity": "MODERATE"
},
"details": "Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.",
"id": "GHSA-m44c-8m5v-q44r",
"modified": "2025-10-14T18:30:30Z",
"published": "2025-10-14T18:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55332"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55332"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M9GV-6P22-QGMJ
Vulnerability from github – Published: 2024-07-05 20:08 – Updated: 2024-07-05 20:08
VLAI
Summary
ai-controller-frontend payment status in basket isn't reset
Details
Impact
Payment status in basket isn't reset
Severity
5.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "aimeos/ai-controller-frontend"
},
"ranges": [
{
"events": [
{
"introduced": "2023.04.1"
},
{
"fixed": "2023.10.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "aimeos/ai-controller-frontend"
},
"ranges": [
{
"events": [
{
"introduced": "2022.04.1"
},
{
"fixed": "2022.10.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "aimeos/ai-controller-frontend"
},
"ranges": [
{
"events": [
{
"introduced": "2021.04.1"
},
{
"fixed": "2021.10.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "aimeos/ai-controller-frontend"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2020.10.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-39325"
],
"database_specific": {
"cwe_ids": [
"CWE-841"
],
"github_reviewed": true,
"github_reviewed_at": "2024-07-05T20:08:44Z",
"nvd_published_at": "2024-07-02T21:15:11Z",
"severity": "MODERATE"
},
"details": "### Impact\nPayment status in basket isn\u0027t reset\n",
"id": "GHSA-m9gv-6p22-qgmj",
"modified": "2024-07-05T20:08:44Z",
"published": "2024-07-05T20:08:44Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/aimeos/ai-controller-frontend/security/advisories/GHSA-m9gv-6p22-qgmj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39325"
},
{
"type": "WEB",
"url": "https://github.com/aimeos/ai-controller-frontend/commit/16b8837d2466e3665b3c826ce87934b01a847268"
},
{
"type": "WEB",
"url": "https://github.com/aimeos/ai-controller-frontend/commit/24a57001e56759d1582d2a0080fc1ca3ba328630"
},
{
"type": "WEB",
"url": "https://github.com/aimeos/ai-controller-frontend/commit/28549808e0f6432a34cd3fb95556deeb86ca276d"
},
{
"type": "WEB",
"url": "https://github.com/aimeos/ai-controller-frontend/commit/b1960c0b6e5ee93111a5360c9ce949b3e7528cf7"
},
{
"type": "WEB",
"url": "https://github.com/aimeos/ai-controller-frontend/commit/dafa072783bb692f111ed092d9d2932c113eb855"
},
{
"type": "PACKAGE",
"url": "https://github.com/aimeos/ai-controller-frontend"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "ai-controller-frontend payment status in basket isn\u0027t reset"
}
GHSA-MC5J-F6WX-H9QH
Vulnerability from github – Published: 2026-06-25 18:45 – Updated: 2026-06-25 18:45
VLAI
Summary
Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission
Details
A flaw in the handling of recovery codes for app-based multi-factor authentication allows the same recovery code to be reused via concurrent submission. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled.
If an attacker gains access to both the user's password and their recovery codes, they get two authenticated sessions per recovery code burned instead of one, or more if they batch the parallel submissions wider, materially extending the attacker's window of access compared to what the single-use guarantee implies.
Severity
7.4 (High)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "filament/filament"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.11.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "filament/filament"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.6.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-48505"
],
"database_specific": {
"cwe_ids": [
"CWE-362",
"CWE-841"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-25T18:45:45Z",
"nvd_published_at": "2026-06-22T22:16:47Z",
"severity": "HIGH"
},
"details": "A flaw in the handling of recovery codes for **app-based multi-factor authentication** allows the same recovery code to be reused via concurrent submission. This issue does **not** affect email-based MFA. It also only applies when recovery codes are enabled.\n\nIf an attacker gains access to both the user\u0027s password and their recovery codes, they get two authenticated sessions per recovery code burned instead of one, or more if they batch the parallel submissions wider, materially extending the attacker\u0027s window of access compared to what the single-use guarantee implies.",
"id": "GHSA-mc5j-f6wx-h9qh",
"modified": "2026-06-25T18:45:46Z",
"published": "2026-06-25T18:45:45Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/filamentphp/filament/security/advisories/GHSA-mc5j-f6wx-h9qh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48505"
},
{
"type": "PACKAGE",
"url": "https://github.com/filamentphp/filament"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.