Weakness (CWE)
CWE-187: Partial String Comparison
The product performs a string comparison that only examines a portion of the string before determining whether there is a match.
How to prevent it (1 mitigation)
-
Testing
Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.
Source: MITRE CWE-187
4 results · Clear filters · Feed
-
High 7.5
Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation
A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An att…
-
High 7.5
Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served as a static file using a simple string prefix check. When configured with URL prefixes such as "/css", it matc…
-
High 8.1
ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header
ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value i…
-
High 8.1
IBM MQ Container authentication bypass
IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configurations due to a partial string comparison vulnerability. IBM X-Force ID: 297169.