Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1025: Comparison Using Wrong Factors

Class Incomplete

The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities.

Source: MITRE CWE-1025

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-78619

    Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically

    Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically. The helper searches the recovery model for the submitted code's digest alone, …

  • Critical 9.3
    CVE-2025-25306

    Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes

    Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the `id` and `url` fields of ActivityPub objects. An attacker can forge an object where they claim authority in the `ur…

    misskey-dev misskey