CWE-923
Improper Restriction of Communication Channel to Intended Endpoints
The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
Impactr finds and proves whether CWE-923 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.