v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
RULES CATALOGUE

Every rule earns its place.

Each rule maps to a CWE and ships a vulnerable and a safe example. Filter by language, category, severity, or by how often AI coding tools generate it.

OWASP coverage → AI prevalence = how often Copilot / Cursor / Claude generate the anti-pattern by default

Dataflow analysis. 10 rules run in dataflow (taint) mode · OAuthLint traces untrusted input and sensitive data from source to a dangerous sink, catching multi-line bugs that pattern rules miss. See the proof →

271 rules
RULE SEVERITY CATEGORY AI LANG
better-auth's CSRF / origin protection is explicitly disabled.
 ● HIGH betterauth ● MEDIUM js · ts
The better-auth secret is set to a hard-coded string literal.
 ● HIGH betterauth ● HIGH js · ts
better-auth is configured to issue insecure session cookies.
 ● MEDIUM betterauth ● MEDIUM js · ts
A fully-permissive wildcard appears in better-auth's trustedOrigins.
 ● HIGH betterauth ● MEDIUM js · ts
An auth-looking cookie is being set with a maxAge greater than 30 days.
 ● LOW cookie ● MEDIUM js · ts
A session/auth cookie is being set WITHOUT the HttpOnly flag.
 ● MEDIUM cookie ● HIGH js · ts
A session/auth cookie is being set WITHOUT the SameSite attribute.
 ● LOW cookie ● MEDIUM js · ts
A cookie that looks like a session or auth cookie is being set WITHOUT the Secure flag.
 ● MEDIUM cookie ● HIGH js · ts
A cookie is being set with SameSite=None but WITHOUT Secure.
 ● MEDIUM cookie ● MEDIUM js · ts
CORS is configured to allow the literal origin 'null'.
 ● HIGH cors ● MEDIUM js · ts
CORS is configured to echo the request's Origin back as Access-Control-Allow-Origin.
 ● HIGH cors ● MEDIUM js · ts
CORS is configured with Access-Control-Allow-Origin: * and Access-Control-Allow-Credentials: true at the same time.
 ● HIGH cors ● HIGH js · ts
A cookie is created with HttpOnly = false, making it readable from client-side JavaScript.
 ● HIGH csharp-cookie ● MEDIUM C#
A cookie is set to SameSite = SameSiteMode.None, which removes the SameSite defense and sends the cookie on cross-site requests.
 ● MEDIUM csharp-cookie ● MEDIUM C#
A cookie policy is set to SecurePolicy = CookieSecurePolicy.None, which lets authentication and session cookies be sent over plain HTTP.
 ● HIGH csharp-cookie ● MEDIUM C#
A CORS policy combines credentialed requests with a wildcard or reflected origin (AllowCredentials() together with AllowAnyOrigin() or SetIsOriginAllowed(...) that returns true for everything).
 ● HIGH csharp-cors ● HIGH C#
A symmetric cipher is configured with CipherMode.ECB.
 ● MEDIUM csharp-crypto ● MEDIUM C#
A security-sensitive value is generated with System.Random or Guid.NewGuid() inside a token/secret/OTP generator.
 ● HIGH csharp-crypto ● HIGH C#
A password is hashed with a fast general-purpose digest (MD5, SHA1, SHA256, SHA512) from System.Security.Cryptography.
 ● HIGH csharp-crypto ● HIGH C#
A redirect target comes straight from user input (a query-string value or a returnUrl-style parameter) and is passed to Redirect(...) without a local-URL check.
 ● MEDIUM csharp-flow ● MEDIUM C#
A JWT signing key is built from a hard-coded string literal (new SymmetricSecurityKey(Encoding.UTF8.GetBytes("..."))).
 ● HIGH csharp-jwt ● HIGH C#
A JWT is decoded with a read-only API that performs NO validation (new JwtSecurityToken(tokenString), handler.ReadJwtToken(...), or new JsonWebToken(tokenString)).
 ● MEDIUM csharp-jwt ● HIGH C#
A JWT setup sets RequireExpirationTime = false on TokenValidationParameters.
 ● MEDIUM csharp-jwt ● MEDIUM C#
A JWT setup sets RequireSignedTokens = false on TokenValidationParameters.
 ● HIGH csharp-jwt ● MEDIUM C#
A custom SignatureValidator on TokenValidationParameters returns a parsed token WITHOUT verifying its signature: it just constructs and returns new JwtSecurityToken(token) / new JsonWebToken(token).
 ● HIGH csharp-jwt ● MEDIUM C#
A JWT bearer setup disables audience validation (ValidateAudience = false) on TokenValidationParameters.
 ● HIGH csharp-jwt ● MEDIUM C#
A JWT bearer setup disables issuer validation (ValidateIssuer = false) on TokenValidationParameters.
 ● HIGH csharp-jwt ● MEDIUM C#
A JWT bearer setup disables lifetime validation (ValidateLifetime = false) on TokenValidationParameters.
 ● HIGH csharp-jwt ● MEDIUM C#
A JWT bearer setup disables signature validation (ValidateIssuerSigningKey = false) on TokenValidationParameters.
 ● HIGH csharp-jwt ● MEDIUM C#
An OAuth/OIDC client secret is assigned from a hard-coded string literal (options.ClientSecret = "...").
 ● HIGH csharp-oauth ● HIGH C#
An OpenID Connect handler turns PKCE off (UsePkce = false).
 ● HIGH csharp-oauth ● MEDIUM C#
An OIDC/JWT bearer handler disables HTTPS for its metadata and token exchange (RequireHttpsMetadata = false).
 ● HIGH csharp-oauth ● MEDIUM C#
TLS server-certificate validation is turned off: the handler accepts any certificate via DangerousAcceptAnyServerCertificateValidator or a callback that always returns true.
 ● HIGH csharp-tls ● HIGH C#
The middleware pipeline calls UseAuthorization() BEFORE UseAuthentication().
 ● HIGH csharp-web ● MEDIUM C#
An authentication/authorization middleware does nothing but call next().
 ● HIGH express ● MEDIUM js · ts
An Express session cookie is explicitly configured as insecure.
 ● MEDIUM express ● MEDIUM js · ts
cookie-parser is initialised with a hard-coded string secret (cookieParser('some-secret')).
 ● HIGH express ● MEDIUM js · ts
A Helmet security header is explicitly turned off.
 ● MEDIUM express ● MEDIUM js · ts
A static file handler is configured with dotfiles: 'allow', which serves dotfiles from the mounted directory.
 ● HIGH express ● LOW js · ts
Express is configured to trust EVERY proxy (app.set('trust proxy', true) or the equivalent app.enable('trust proxy')).
 ● MEDIUM express ● MEDIUM js · ts
@fastify/cookie, @fastify/session, or @fastify/secure-session is registered with a hard-coded secret string literal.
 ● HIGH fastify ● HIGH js · ts
@fastify/cors is registered with a wildcard/reflected origin (origin: '*' or origin: true) together with credentials: true.
 ● HIGH fastify ● MEDIUM js · ts
@fastify/jwt is registered with a hard-coded secret string literal.
 ● HIGH fastify ● HIGH js · ts
Fastify is created with trustProxy: true, which trusts EVERY proxy.
 ● MEDIUM fastify ● MEDIUM js · ts
HTTP Basic credentials flow into a logging call (console.* or logger.*).
 ● HIGH flow ● MEDIUM js · ts
A secret credential is placed in a URL query string.
 ● HIGH flow ● HIGH js · ts
Math.random() produces a value whose name marks it as security-sensitive.
 ● HIGH flow ● HIGH js · ts
A /login, /signin, /auth, or /reset-password POST handler is registered without any rate-limit middleware in scope.
 ● LOW flow ● HIGH js · ts
An OAuth/OIDC credential from the request flows into a logging call.
 ● HIGH flow ● MEDIUM js · ts
Untrusted request input flows into a redirect destination.
 ● HIGH flow ● HIGH js · ts
A password validation schema is enforcing a minimum length of less than 8 characters.
 ● MEDIUM flow ● MEDIUM js · ts
A user-supplied password is being persisted WITHOUT being hashed first.
 ● HIGH flow ● MEDIUM js · ts
A secret-shaped value is passed to a logging call.
 ● MEDIUM flow ● HIGH js · ts
A server-side secret read from process.env flows into an HTTP response body.
 ● HIGH flow ● HIGH js · ts
auth.flow.ssrf DATAFLOW
Untrusted request input flows into the URL of an outbound HTTP request.
 ● HIGH flow ● HIGH js · ts
A secret-shaped value (password, token, secret, apiKey, csrf, hmac) is being compared with === / !== / string1 == string2.
 ● MEDIUM flow ● MEDIUM js · ts
A bcrypt cost factor below 10 was used.
 ● MEDIUM flow ● MEDIUM js · ts
A password is being hashed with a fast, general-purpose hash (MD5/SHA-1/SHA-256/SHA-512 via crypto.createHash).
 ● HIGH flow ● HIGH js · ts
A Gin auth/session cookie is written with secure or httpOnly set to a literal false.
 ● HIGH go-cookie ● HIGH go
A session/auth http.Cookie is created with a security attribute explicitly disabled (Secure: false or HttpOnly: false).
 ● HIGH go-cookie ● HIGH go
CORS is configured to allow every origin with the wildcard *.
 ● HIGH go-cors ● HIGH go
An Echo CORS middleware is configured to allow every origin with the wildcard "*".
 ● HIGH go-cors ● HIGH go
A Fiber CORS middleware is configured with the wildcard origin "*".
 ● HIGH go-cors ● HIGH go
bcrypt.GenerateFromPassword is called with a cost factor below 10.
 ● MEDIUM go-crypto ● MEDIUM go
A broken or deprecated block/stream cipher is used to protect data.
 ● HIGH go-crypto ● MEDIUM go
A password is being hashed with a fast, general-purpose digest from the Go standard library (MD5, SHA-1, SHA-256, SHA-512).
 ● HIGH go-crypto ● HIGH go
An OAuth/OIDC credential from the HTTP request flows into a logging call.
 ● HIGH go-flow ● MEDIUM go
Untrusted request data flows into an HTTP redirect destination.
 ● HIGH go-flow ● HIGH go
A server-side secret read from the environment flows into an HTTP response body, leaking it to the client.
 ● HIGH go-flow ● HIGH go
Untrusted request data flows into the URL of an outbound HTTP request.
 ● HIGH go-flow ● HIGH go
A security-sensitive value is being generated with the math/rand package.
 ● HIGH go-flow ● HIGH go
The Echo JWT middleware (labstack/echo-jwt) is configured with a hardcoded string-literal SigningKey.
 ● HIGH go-jwt ● HIGH go
The Fiber JWT middleware (gofiber/contrib/jwt) is configured with a hardcoded string-literal signing key (SigningKey: jwtware.SigningKey{Key: []byte("...")}).
 ● HIGH go-jwt ● HIGH go
A JWT HMAC signing/verification key is hardcoded as a string literal in a call to golang-jwt.
 ● HIGH go-jwt ● HIGH go
A JWT is created or accepted with the none algorithm, which produces an unsigned token.
 ● HIGH go-jwt ● HIGH go
A JWT is decoded with ParseUnverified, which parses the token WITHOUT checking its signature.
 ● HIGH go-jwt ● HIGH go
A JWT parser turns off registered-claims validation with jwt.WithoutClaimsValidation().
 ● MEDIUM go-jwt ● MEDIUM go
A JWT Keyfunc returns the verification key without checking token.Method, enabling algorithm confusion.
 ● HIGH go-jwt ● HIGH go
Untrusted request input flows into the verification key returned by a golang-jwt Keyfunc (or into the WithValidMethods allowlist).
 ● HIGH go-jwt ● LOW go
An oauth2.Config is built with a hardcoded string-literal ClientSecret.
 ● HIGH go-oauth ● MEDIUM go
An OAuth/OIDC endpoint is being contacted over cleartext http://.
 ● HIGH go-oauth ● MEDIUM go
OAuth token request uses the Resource Owner Password Credentials grant (grant_type=password).
 ● HIGH go-oauth ● MEDIUM go
OAuth authorization request is built with a hardcoded, constant state value.
 ● MEDIUM go-oauth ● MEDIUM go
A gorilla/sessions or securecookie store is initialized with a hardcoded string-literal key.
 ● HIGH go-session ● HIGH go
A tls.Config sets InsecureSkipVerify: true, disabling TLS certificate verification.
 ● HIGH go-tls ● HIGH go
A tls.Config is created with MinVersion pinned to an obsolete protocol: SSL 3.0, TLS 1.0, or TLS 1.1.
 ● HIGH go-tls ● MEDIUM go
A session/auth cookie is set with Hono's setCookie(c, name, value, ...) helper WITHOUT the Secure flag, or with secure/httpOnly explicitly disabled.
 ● MEDIUM hono ● MEDIUM js · ts
Hono's cors() middleware is given an origin function that reflects the caller's origin straight back (origin: (origin) => origin) together with credentials: true.
 ● HIGH hono ● MEDIUM js · ts
Hono's jwt() middleware from hono/jwt is configured with a hard-coded secret string literal.
 ● HIGH hono ● HIGH js · ts
A servlet Cookie is created with a security attribute explicitly disabled.
 ● HIGH java-cookie ● HIGH java
CORS is configured to allow every origin with the wildcard *.
 ● HIGH java-cors ● HIGH java
CORS is configured to allow any origin together with credentials.
 ● HIGH java-cors ● MEDIUM java
A JCA Cipher is being created in ECB mode (or with a bare algorithm alias that defaults to ECB).
 ● HIGH java-crypto ● MEDIUM java
A security-sensitive value (token, secret, key, password, nonce, OTP, or salt) is generated with a non-cryptographic PRNG.
 ● HIGH java-crypto ● HIGH java
Spring stores passwords with no hashing.
 ● HIGH java-crypto ● HIGH java
A broken hash algorithm (MD5 or SHA-1) is being instantiated via JCA MessageDigest.getInstance(...).
 ● MEDIUM java-crypto ● MEDIUM java
A password is being hashed with a fast, general-purpose digest from the JCA MessageDigest (MD5, SHA-1, SHA-256, SHA-512).
 ● HIGH java-crypto ● HIGH java
Untrusted request input flows into the URL of an outbound HTTP request.
 ● HIGH java-flow ● HIGH java
A JWT signing key is hard-coded as a string literal (CWE-798).
 ● HIGH java-jwt ● HIGH java
This JWT is verified for signature but its intended-recipient claims are never asserted: the Auth0 JWT.require(alg)...build() verifier pins no withIssuer(...)/withAudience(...), or the jjwt parser sets a signature key but pins no requireIssuer(...)/requireAudience(...).
 ● MEDIUM java-jwt ● MEDIUM java
A JWT is created or verified with the none algorithm, which means there is no signature at all.
 ● HIGH java-jwt ● MEDIUM java
This JWT is created or parsed without a signature, so its contents are neither authenticated nor tamper-proof (CWE-347).
 ● HIGH java-jwt ● MEDIUM java
Untrusted request input flows into the JWT verification key.
 ● HIGH java-jwt ● LOW java
An OAuth 2.0 client secret is hard-coded as a string literal in a Spring Security ClientRegistration builder (.clientSecret("...")).
 ● MEDIUM java-oauth ● MEDIUM java
An OAuth/OIDC endpoint is being contacted over cleartext http://.
 ● HIGH java-oauth ● MEDIUM java
OAuth token request uses the Resource Owner Password Credentials grant (grant_type=password).
 ● HIGH java-oauth ● MEDIUM java
OAuth authorization request sends a hardcoded, constant state value.
 ● MEDIUM java-oauth ● MEDIUM java
Spring Security session fixation protection is disabled via sessionFixation().none().
 ● HIGH java-session ● MEDIUM java
TLS hostname verification is disabled.
 ● HIGH java-tls ● HIGH java
Spring Security CSRF protection is disabled.
 ● HIGH java-web ● HIGH java
Spring Security's X-Frame-Options header is disabled.
 ● MEDIUM java-web ● MEDIUM java
Spring Security authorizes every request without authentication via anyRequest().permitAll().
 ● HIGH java-web ● HIGH java
Spring Security grants permitAll() to a sensitive management path.
 ● MEDIUM java-web ● MEDIUM java
Spring excludes all paths from the security filter chain.
 ● HIGH java-web ● MEDIUM java
Spring permits every request via a catch-all matcher.
 ● HIGH java-web ● HIGH java
JWTs are being verified with the none algorithm in the allowed list.
 ● HIGH jwt ● HIGH js · ts
A JWT is being verified with HS256 (a symmetric algorithm) but the key looks like an RSA / EC public key in PEM format.
 ● HIGH jwt ● MEDIUM js · ts
jwt.decode() from jsonwebtoken only parses the token.
 ● MEDIUM jwt ● HIGH js · ts
ignoreExpiration: true in a jsonwebtoken verify() call disables the exp claim check.
 ● MEDIUM jwt ● HIGH js · ts
A JWT-looking value (header eyJ…) appears in a URL query string or fragment.
 ● HIGH jwt ● MEDIUM js · ts
A JWT (or other auth token) is being written to localStorage.
 ● MEDIUM jwt ● HIGH js · ts
jwt.verify(...) is called without an explicit algorithms allowlist.
 ● MEDIUM jwt ● HIGH js · ts
JWT is being verified without checking the aud (audience) claim.
 ● MEDIUM jwt ● MEDIUM js · ts
JWT is signed without any expiresIn / exp claim, OR a token is verified without an maxAge check.
 ● MEDIUM jwt ● HIGH js · ts
JWT is being verified without checking the iss (issuer) claim.
 ● LOW jwt ● LOW js · ts
Untrusted request input flows into the verification key or the algorithms allowlist of jwt.verify(...).
 ● HIGH jwt ● LOW js · ts
JWT signing or verification uses a hard-coded secret.
 ● HIGH jwt ● HIGH js · ts
An authentication / OAuth endpoint is called over cleartext http://.
 ● MEDIUM kotlin-android ● MEDIUM Kotlin
An OAuth client secret / API key / password is assigned from a hard-coded string literal.
 ● HIGH kotlin-android ● HIGH Kotlin
An AppAuth AuthorizationRequest.Builder explicitly disables PKCE with .setCodeVerifier(null).
 ● MEDIUM kotlin-android ● LOW Kotlin
An auth token / secret is written to plain SharedPreferences (prefs.edit().putString("auth_token", ...)).
 ● HIGH kotlin-android ● HIGH Kotlin
An OAuth authorization URL is loaded inside an in-app WebView (webView.loadUrl("...authorize?client_id=...")).
 ● MEDIUM kotlin-android ● HIGH Kotlin
A WebViewClient.onReceivedSslError(...) handler calls handler.proceed(), telling the WebView to ignore a TLS certificate error and load the page anyway.
 ● HIGH kotlin-android ● MEDIUM Kotlin
A Ktor session cookie is configured without cookie.secure = true, so the browser will send it over plain HTTP as well as HTTPS.
 ● MEDIUM kotlin-cookie ● MEDIUM Kotlin
A Ktor CORS configuration combines anyHost() with allowCredentials = true.
 ● HIGH kotlin-cors ● HIGH Kotlin
A JWT signer or verifier is built with Algorithm.none(), the unsecured algorithm that produces (and accepts) tokens with no signature.
 ● HIGH kotlin-jwt ● MEDIUM Kotlin
A JWT is decoded but its signature is never verified.
 ● MEDIUM kotlin-jwt ● HIGH Kotlin
This JWT verifier checks the signature but never asserts the token's intended recipient: the Auth0 JWT.require(alg)...build() chain pins no .withIssuer(...) and no .withAudience(...).
 ● MEDIUM kotlin-jwt ● MEDIUM Kotlin
A JWT signing key is built from a hard-coded string literal (Algorithm.HMAC256("...")).
 ● HIGH kotlin-secret ● HIGH Kotlin
This MCP StreamableHTTPServerTransport is created without DNS-rebinding protection (CWE-346).
 ● HIGH mcp ● HIGH js · ts
This MCP server enforces bearer auth via requireBearerAuth(...) but passes no resourceMetadataUrl.
 ● MEDIUM mcp ● HIGH js · ts
This MCP StreamableHTTPServerTransport derives its session id from a predictable source: Date.now(), Math.random(), or an incrementing counter (CWE-330).
 ● MEDIUM mcp ● MEDIUM js · ts
An MCP server forwards the INCOMING caller token to an upstream API (token pass-through).
 ● HIGH mcp ● HIGH js · ts
An argument of an MCP tool handler (server.registerTool / server.tool) flows into an outbound HTTP request without validation, a server-side request forgery (SSRF, CWE-918).
 ● HIGH mcp ● HIGH js · ts
This MCP transport is mounted on an Express route with NO auth middleware.
 ● HIGH mcp ● HIGH js · ts
NestJS app.enableCors() is configured with a wildcard/reflected origin (origin: '*' or origin: true) together with credentials: true.
 ● HIGH nestjs ● MEDIUM js · ts
A NestJS guard's canActivate returns a constant true.
 ● HIGH nestjs ● MEDIUM js · ts
A NestJS JwtModule is configured with a hard-coded secret (or secretOrPrivateKey) string literal.
 ● HIGH nestjs ● HIGH js · ts
The NextAuth/Auth.js authorized callback returns true unconditionally.
 ● HIGH nextauth ● HIGH js · ts
A NextAuth/Auth.js custom cookie is configured as insecure.
 ● MEDIUM nextauth ● MEDIUM js · ts
The NextAuth/Auth.js config hard-codes debug: true.
 ● MEDIUM nextauth ● MEDIUM js · ts
The NextAuth/Auth.js secret is set to a hard-coded string literal.
 ● HIGH nextauth ● HIGH js · ts
The NextAuth/Auth.js redirect callback returns the incoming url without validating it against baseUrl.
 ● HIGH nextauth ● HIGH js · ts
The NextAuth/Auth.js session callback copies an OAuth token onto the session object.
 ● MEDIUM nextauth ● MEDIUM js · ts
An OAuth access_token (or refresh_token / id_token) is placed in a URL query string.
 ● MEDIUM oauth ● MEDIUM js · ts
OAuth scope request includes an over-broad scope such as admin, full_access, *, or repo (entire GitHub access).
 ● LOW oauth ● HIGH js · ts
An OAuth client_secret (or similarly sensitive credential) is being assigned a hard-coded string literal.
 ● HIGH oauth ● HIGH js · ts
OAuth implicit flow is deprecated by the OAuth 2.0 Security BCP (RFC 9700) and the OAuth 2.1 draft.
 ● HIGH oauth ● MEDIUM js · ts
An OAuth/OIDC endpoint is being contacted over cleartext http://.
 ● HIGH oauth ● MEDIUM js · ts
An OAuth token-lifetime field is set to a literal value longer than 24 hours.
 ● MEDIUM oauth ● MEDIUM js · ts
OIDC authorization request (scope contains openid) is being built WITHOUT a nonce parameter.
 ● MEDIUM oauth ● MEDIUM js · ts
OAuth authorization request from a public client omits the PKCE code_challenge parameter.
 ● MEDIUM oauth ● HIGH js · ts
OAuth 2.0 authorization request is being built WITHOUT a state parameter.
 ● HIGH oauth ● HIGH js · ts
OAuth callback handler reads state from the request but never compares it to a stored value.
 ● MEDIUM oauth ● HIGH js · ts
The OAuth callback handler redirects to a URL taken straight from the request without validating it.
 ● HIGH oauth ● HIGH js · ts
PKCE is configured with code_challenge_method=plain.
 ● MEDIUM oauth ● MEDIUM js · ts
OAuth token request uses the Resource Owner Password Credentials grant (grant_type=password).
 ● HIGH oauth ● MEDIUM js · ts
OAuth authorization request sends a hardcoded, constant state value.
 ● MEDIUM oauth ● MEDIUM js · ts
An OAuth/OIDC token is written to localStorage / sessionStorage, readable by any script on the origin.
 ● MEDIUM oauth ● HIGH js · ts
OAuth redirect_uri allow-list contains a wildcard, an http:// URL, or localhost.
 ● HIGH oauth ● MEDIUM js · ts
A passport-jwt strategy is configured with ignoreExpiration: true.
 ● MEDIUM passport ● MEDIUM js · ts
An authentication-related cookie is set without the Secure and/or HttpOnly flags (or with SameSite=None).
 ● MEDIUM php-cookie ● HIGH PHP
A Laravel session config hard-codes an insecure cookie flag: 'secure' => false, 'http_only' => false, or 'same_site' => 'none'.
 ● MEDIUM php-cookie ● MEDIUM PHP
This endpoint sends Access-Control-Allow-Credentials: true together with an Access-Control-Allow-Origin that is either the wildcard * or the request's own Origin reflected back unchecked.
 ● MEDIUM php-cors ● MEDIUM PHP
A Laravel Socialite OAuth flow calls ->stateless(), which disables the state parameter that ties the redirect to the user's session.
 ● MEDIUM php-flow ● MEDIUM PHP
A JWT payload is read by hand (json_decode(base64_decode($parts[1])) on the second dot-segment of a token) without ever verifying the signature.
 ● HIGH php-jwt ● HIGH PHP
A JWT is configured with an unsecured / none signer, e.g. Configuration::forUnsecuredSigner() or new Signer\None() (lcobucci/jwt), or the 'none' algorithm passed to JWT::encode() / new Key(...) (firebase/php-jwt).
 ● HIGH php-jwt ● MEDIUM PHP
A JWT signing key is a hard-coded string literal, passed to JWT::encode() / new Key() (firebase/php-jwt) or InMemory::plainText() / InMemory::base64Encoded() (lcobucci/jwt).
 ● HIGH php-secret ● HIGH PHP
A PHP session hardening flag is turned off at runtime with ini_set(): session.cookie_httponly, session.cookie_secure, or session.use_only_cookies set to 0 / '0' / false.
 ● MEDIUM php-session ● MEDIUM PHP
A session/auth cookie is issued with a security attribute explicitly disabled.
 ● HIGH py-cookie ● HIGH python
Flask-CORS allows any origin while credentials are enabled.
 ● HIGH py-cors ● MEDIUM python
FastAPI CORS allows any origin with credentials.
 ● HIGH py-cors ● HIGH python
A symmetric cipher is configured in ECB mode.
 ● MEDIUM py-crypto ● MEDIUM python
passlib configured with a weak or plaintext password scheme.
 ● HIGH py-crypto ● MEDIUM python
django-cors-headers is configured to allow every origin, disabling cross-origin access control.
 ● MEDIUM py-django ● MEDIUM python
DRF disables authentication globally with an empty DEFAULT_AUTHENTICATION_CLASSES list.
 ● HIGH py-drf ● MEDIUM python
DRF makes every endpoint public because DEFAULT_PERMISSION_CLASSES is set to AllowAny.
 ● HIGH py-drf ● HIGH python
A DRF view disables authentication with an empty authentication_classes list.
 ● HIGH py-drf ● MEDIUM python
A FastAPI security dependency (Security(...), an API-key scheme such as APIKeyHeader/APIKeyQuery/APIKeyCookie, or an OAuth2 bearer scheme) injects a credential that is then compared against a hard-coded string literal.
 ● HIGH py-fastapi ● MEDIUM python
A FastAPI HTTP Basic auth dependency compares the request's username or password against a hard-coded string literal.
 ● HIGH py-fastapi ● HIGH python
Starlette's SessionMiddleware is configured with a hard-coded secret_key string literal.
 ● HIGH py-fastapi ● HIGH python
Starlette's TrustedHostMiddleware is added but configured to trust every Host header (allowed_hosts=["*"], or a list that contains "*").
 ● MEDIUM py-fastapi ● MEDIUM python
A Flask cookie security flag is disabled through app.config, weakening session and remember-me cookie protection.
 ● HIGH py-flask ● MEDIUM python
A Django view disables CSRF protection.
 ● MEDIUM py-flow ● HIGH python
Debug mode is hard-coded to True.
 ● MEDIUM py-flow ● HIGH python
A security-sensitive value is being generated with the random module.
 ● HIGH py-flow ● HIGH python
An OAuth/OIDC credential from the request flows into a logging call.
 ● HIGH py-flow ● MEDIUM python
Untrusted request data flows into a Flask redirect(...) without validation, an open redirect (CWE-601).
 ● HIGH py-flow ● HIGH python
A requests call disables TLS certificate verification with verify=False.
 ● HIGH py-flow ● HIGH python
A server-side secret read from the environment flows into an HTTP response sent back to the client, leaking it (CWE-200).
 ● HIGH py-flow ● HIGH python
Untrusted request data flows into an outbound HTTP request without validation, a Server-Side Request Forgery (SSRF, CWE-918).
 ● HIGH py-flow ● HIGH python
A password is being hashed with a fast, general-purpose digest from hashlib (MD5, SHA-1, SHA-256, SHA-512).
 ● HIGH py-flow ● HIGH python
A JWT is decoded or signed with the none algorithm.
 ● HIGH py-jwt ● HIGH python
A JWT is decoded with an algorithms allowlist that mixes an HMAC algorithm with an asymmetric one.
 ● HIGH py-jwt ● MEDIUM python
A JWT signing/verification key is hardcoded as a string literal in the call to PyJWT.
 ● HIGH py-jwt ● HIGH python
A JWT is decoded with a verification key but WITHOUT an explicit algorithms allowlist.
 ● MEDIUM py-jwt ● HIGH python
A JWT is decoded with options={"verify_exp": False}, which turns off PyJWT's exp (expiration) check.
 ● MEDIUM py-jwt ● HIGH python
A JWT is decoded with signature verification disabled.
 ● HIGH py-jwt ● HIGH python
Untrusted request input flows into the verification key or the algorithms allowlist of jwt.decode(...) (PyJWT / python-jose).
 ● HIGH py-jwt ● LOW python
PyJWT decode disables audience or issuer checks.
 ● MEDIUM py-jwt ● MEDIUM python
This FastMCP server binds to 0.0.0.0 and serves a network transport (streamable-http / SSE) without DNS-rebinding protection (CWE-346).
 ● MEDIUM py-mcp ● MEDIUM python
This MCP server enables auth via AuthSettings(...) but never sets resource_server_url.
 ● MEDIUM py-mcp ● HIGH python
An MCP server forwards the INCOMING caller token to an upstream API (token pass-through).
 ● HIGH py-mcp ● HIGH python
An argument of an MCP tool handler (@mcp.tool()) flows into an outbound HTTP request without validation, a server-side request forgery (SSRF, CWE-918).
 ● HIGH py-mcp ● HIGH python
This MCP server is exposed over a NETWORK transport (streamable-http / SSE) but was constructed with no authentication: no auth= and no token_verifier=.
 ● HIGH py-mcp ● HIGH python
An OAuth client secret is passed as a string literal to the OAuth client.
 ● HIGH py-oauth ● HIGH python
An OAuth/OIDC endpoint is being contacted over cleartext http://.
 ● HIGH py-oauth ● MEDIUM python
OAUTHLIB_INSECURE_TRANSPORT is set, disabling oauthlib's HTTPS requirement for OAuth flows.
 ● HIGH py-oauth ● HIGH python
OAuth token request uses the Resource Owner Password Credentials grant (grant_type=password).
 ● HIGH py-oauth ● MEDIUM python
OAuth authorization request sends a hardcoded, constant state value.
 ● MEDIUM py-oauth ● MEDIUM python
An OAuth client fetches or refreshes a token with TLS certificate verification disabled (verify=False).
 ● HIGH py-oauth ● MEDIUM python
The Django SECRET_KEY is set to a hard-coded string literal in settings.
 ● HIGH py-secret ● HIGH python
The Flask SECRET_KEY (used to sign session cookies and CSRF tokens) is set to a hard-coded string literal.
 ● HIGH py-secret ● HIGH python
The Rails cookie session store is configured with secure: false or httponly: false.
 ● MEDIUM ruby-cookie ● MEDIUM Ruby
A rack-cors allow block combines origins '*' with credentials: true.
 ● MEDIUM ruby-cors ● HIGH Ruby
A JWT is encoded or decoded with the none algorithm, which produces (and accepts) unsigned tokens.
 ● HIGH ruby-jwt ● MEDIUM Ruby
JWT.decode is called with its third positional argument set to false, which disables signature verification entirely.
 ● HIGH ruby-jwt ● HIGH Ruby
JWT.decode is called with verification enabled (true) but no algorithm: / algorithms: option, so the library trusts whatever alg the token header names.
 ● MEDIUM ruby-jwt ● HIGH Ruby
A Doorkeeper (OAuth provider) initializer weakens a core protection: force_ssl_in_redirect_uri false allows plaintext http:// redirect URIs (authorization codes/tokens travel in cleartext and are open to interception/redirect tampering, CWE-601); allow_blank_redirect_uri true accepts clients with no registered redirect URI; and an unconditional skip_authorization do true end auto-approves EVERY client with no user consent.
 ● MEDIUM ruby-oauth ● MEDIUM Ruby
OmniAuth is configured to accept GET requests on the request phase (allowed_request_methods includes :get, or silence_get_warning is set to true).
 ● MEDIUM ruby-oauth ● MEDIUM Ruby
An OmniAuth provider is configured with provider_ignores_state: true, which disables verification of the OAuth state parameter on the callback.
 ● HIGH ruby-oauth ● MEDIUM Ruby
The HMAC key passed to JWT.encode / JWT.decode is a hard-coded string literal.
 ● HIGH ruby-secret ● HIGH Ruby
A Rails secret_key_base / secret_key is assigned a hard-coded string literal.
 ● HIGH ruby-secret ● MEDIUM Ruby
A Rails controller disables CSRF protection with skip_before_action :verify_authenticity_token.
 ● MEDIUM ruby-session ● HIGH Ruby
A session/auth cookie is built with a security attribute explicitly disabled (secure(false) or http_only(false)).
 ● HIGH rust-cookie ● HIGH rust
A wide-open CORS policy is configured.
 ● HIGH rust-cors ● MEDIUM rust
bcrypt::hash (or bcrypt::hash_with_result) is called with a cost factor below 10.
 ● MEDIUM rust-crypto ● MEDIUM rust
A broken or deprecated cipher from the RustCrypto ecosystem is used to protect data.
 ● HIGH rust-crypto ● MEDIUM rust
A password is hashed with a fast, general-purpose digest unsuitable for password storage.
 ● HIGH rust-crypto ● HIGH rust
Untrusted request input flows into the URL of an outbound HTTP request.
 ● HIGH rust-flow ● HIGH rust
A secret-shaped value (password, token, secret, apikey, hmac, signature, mac, digest) is being compared with == / !=.
 ● MEDIUM rust-flow ● MEDIUM rust
A jsonwebtoken Validation accepts both HMAC and asymmetric algorithms, enabling algorithm confusion.
 ● HIGH rust-jwt ● MEDIUM rust
Validation::insecure_disable_signature_validation() turns off JWT signature verification.
 ● HIGH rust-jwt ● MEDIUM rust
A JWT HMAC signing/verification key is hardcoded as a literal.
 ● HIGH rust-jwt ● HIGH rust
JWT audience (aud) validation is disabled by setting validate_aud: false on the jsonwebtoken Validation.
 ● MEDIUM rust-jwt ● MEDIUM rust
JWT expiration validation is turned off by setting validate_exp: false on the jsonwebtoken Validation.
 ● HIGH rust-jwt ● MEDIUM rust
A JWT is decoded with a jsonwebtoken Validation that never sets the expected issuer.
 ● MEDIUM rust-jwt ● MEDIUM rust
An OAuth client_secret is hardcoded as a string literal and passed to the oauth2 crate's ClientSecret::new(...).
 ● HIGH rust-oauth ● HIGH rust
An OAuth/OIDC endpoint is being contacted over cleartext http://.
 ● HIGH rust-oauth ● MEDIUM rust
OAuth token request uses the Resource Owner Password Credentials grant (grant_type=password).
 ● HIGH rust-oauth ● MEDIUM rust
OAuth authorization request is built with a hardcoded, constant state value (CsrfToken::new("literal")).
 ● MEDIUM rust-oauth ● MEDIUM rust
A reqwest client is built with danger_accept_invalid_certs(true), which turns off TLS certificate validation.
 ● HIGH rust-tls ● HIGH rust
A reqwest client is built with danger_accept_invalid_hostnames(true), which turns off TLS hostname verification.
 ● HIGH rust-tls ● HIGH rust
A hard-coded credential matching a well-known provider's key format was found in the source.
 ● HIGH secret ● HIGH js · ts
A secret is being read from an environment variable whose name carries a client-public prefix.
 ● HIGH secret ● HIGH js · ts
An express-session / cookie-session secret is a hard-coded string literal.
 ● HIGH session ● HIGH js · ts
A session token / id appears in a URL query string.
 ● HIGH session ● MEDIUM js · ts
The user is marked as logged in without first regenerating the session id.
 ● MEDIUM session ● MEDIUM js · ts
A Vapor CORSMiddleware.Configuration combines allowedOrigin: .all (the * wildcard) with allowCredentials: true.
 ● MEDIUM swift-cors ● MEDIUM Swift
An ASWebAuthenticationSession explicitly sets prefersEphemeralWebBrowserSession = false.
 ● MEDIUM swift-flow ● MEDIUM Swift
An OAuth / OpenID authorization URL is loaded inside a WKWebView.
 ● MEDIUM swift-flow ● MEDIUM Swift
A JWTKit HMAC signing key is registered from a hard-coded string literal (add(hmac: "...", ...)).
 ● HIGH swift-jwt ● MEDIUM Swift
A Keychain item is created with kSecAttrAccessibleAlways (or kSecAttrAccessibleAlwaysThisDeviceOnly).
 ● MEDIUM swift-keychain ● MEDIUM Swift
A secret, API key, token, or password is assigned from a hard-coded string literal.
 ● HIGH swift-secret ● HIGH Swift
A token, secret, or credential is bound to @AppStorage.
 ● MEDIUM swift-storage ● HIGH Swift
A token, secret, or credential is written to UserDefaults.
 ● HIGH swift-storage ● HIGH Swift
TLS certificate validation is disabled for this connection.
 ● HIGH tls ● HIGH js · ts
An exported activity registers a BROWSABLE intent-filter for a custom-scheme OAuth redirect (android:scheme="com.example.app" with an oauth/callback/ redirect host).
 ● MEDIUM xml-android ● MEDIUM XML
A credential (client secret, API key, password, bearer token) is hard-coded as a value in res/values/strings.xml.
 ● HIGH xml-android ● HIGH XML
The manifest sets android:usesCleartextTraffic="true" on <application>, re-enabling plaintext HTTP for the entire app.
 ● HIGH xml-android ● HIGH XML
A network-security-config permits cleartext traffic (cleartextTrafficPermitted="true") in a <base-config> or in a <domain-config> that is not restricted to a loopback dev host.
 ● MEDIUM xml-android ● MEDIUM XML