CWE-300
Channel Accessible by Non-Endpoint
The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
Impactr finds and proves whether CWE-300 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.