CWE · MITRE source
CWE-807Reliance on Untrusted Inputs in a Security Decision
The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
Developers may assume that inputs such as cookies, environment variables, and hidden form fields cannot be modified. However, an attacker could change these inputs using customized clients or other attacks. This change might not be detected. When security decisions such as authentication and authorization are made based on the values of these inputs, attackers can bypass the security of the software. Without sufficient encryption, integrity checking, or other mechanism, any input that originates from an outsider cannot be trusted.
Last updated: 20 August 2026 13:14 UTC
OWASP Top 10 for Web (2025)
This weakness contributes to A06:2025 Insecure Design.
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
—
- 1 hardening rule · 1 OS baseline
—
NIST 800-53 r5 controls that address this weakness (3)AI-assisted
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
PT-8 | Computer Matching Requirements | PT | Prevents reliance on untrusted matching results for security-relevant decisions by enforcing verification and contest procedures. |
SC-16 | Transmission of Security and Privacy Attributes | SC | Providing authoritative attributes with the data reduces the need for security decisions to rely on untrusted external inputs. |
SI-9 | Information Input Restrictions | SI | Reduces reliance on untrusted inputs by ensuring only authorized sources may supply data. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2026-21509 KEV UPD | 8.5 | 7.8 | 0.7215 | 2026-01-26 |
CVE-2026-21514 KEV | 8.5 | 7.8 | 0.0152 | 2026-02-10 |
CVE-2026-34486 KEV UPD | 8.5 | 7.5 | 0.8293 | 2026-04-09 |
CVE-2025-49827 UPD | 7.6 | 9.8 | 0.0140 | 2025-07-15 |
CVE-2026-24120 UPD | 7.5 | 9.8 | 0.0090 | 2026-05-04 |
CVE-2025-12487 UPD | 7.4 | 9.8 | 0.0085 | 2025-11-06 |
CVE-2025-12488 UPD | 7.4 | 9.8 | 0.0085 | 2025-11-06 |
CVE-2023-45128 UPD | 7.3 | 10.0 | 0.0031 | 2023-10-16 |
CVE-2025-13926 | 7.3 | 9.8 | 0.0044 | 2026-04-09 |
CVE-2026-64827 | 7.3 | 9.8 | 0.0043 | 2026-08-03 |
CVE-2025-66570 | 7.2 | 10.0 | 0.0033 | 2025-12-05 |
CVE-2026-32975 | 7.2 | 9.8 | 0.0034 | 2026-03-29 |
CVE-2026-48491 UPD | 7.2 | 10.0 | 0.0028 | 2026-06-23 |
CVE-2026-44649 UPD | 7.1 | 9.8 | 0.0022 | 2026-05-29 |
CVE-2024-13974 UPD | 6.9 | 8.1 | 0.0670 | 2025-07-21 |
CVE-2021-31999 UPD | 6.8 | 8.8 | 0.0105 | 2021-07-15 |
CVE-2021-41129 UPD | 6.5 | 8.1 | 0.0175 | 2021-10-06 |
CVE-2024-29039 UPD | 6.5 | 9.0 | 0.0098 | 2024-06-28 |
CVE-2026-33068 | 6.5 | 8.8 | 0.0034 | 2026-03-20 |
CVE-2025-1126 UPD | 6.4 | 9.3 | 0.0025 | 2025-02-11 |
CVE-2021-36777 UPD | 6.3 | 8.1 | 0.0091 | 2022-03-09 |
CVE-2026-31892 UPD | 6.1 | 8.1 | 0.0041 | 2026-03-11 |
CVE-2024-28824 UPD | 6.0 | 8.8 | 0.0018 | 2024-03-22 |
CVE-2026-43935 UPD | 6.0 | 8.1 | 0.0030 | 2026-05-26 |
CVE-2026-9561 UPD | 6.0 | 8.2 | 0.0019 | 2026-07-14 |