CWE-441

Unintended Proxy or Intermediary ('Confused Deputy')

Parent: CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

92 vulnerabilities with CWE-441
CVE-2026-27624 HIGH
coturn < 4.9.0 - Improper Access Control via IPv4-Mapped IPv6 Bypass
CVSS 7.2
CVE-2026-24471 CRITICAL
Continuwuity and Conduit Matrix Homeservers - Arbitrary Event Signing
CVE-2026-24470 HIGH
Skipper <0.24.0 - Privilege Escalation
CVSS 8.1
CVE-2025-48570 HIGH
Android 14 PipTaskOrganizer - Background Activity Launch Privilege Escalation
CVSS 7.8
CVE-2025-62718 CRITICAL
Axios <1.15.0 and <0.31.0 NO_PROXY - Server-Side Request Forgery
CVSS 9.9
CVE-2025-48646 HIGH
ActivityStarter.java - Privilege Escalation
CVSS 7.8
CVE-2025-48579 HIGH
MediaProvider.java - Privilege Escalation
CVSS 8.4
CVE-2025-64125 CRITICAL
Nuvation Energy nCloud VPN Service - Info Disclosure
CVE-2025-64123 CRITICAL
Nuvation Energy Multi-Stack Controller <=2.5.1 - Network Boundary Bridging
CVSS 9.8
CVE-2025-68944 MEDIUM
Gitea < 1.22.2 - Unintended Proxy or Intermediary via Token Scope Mishandling
CVSS 5.0
CVE-2025-68667 CRITICAL
Conduit Matrix Homeservers - Forged Membership Event Signing
CVE-2025-11393 HIGH
Runtimes-Inventory-Rhel8-Operator - Privilege Escalation
CVSS 8.7
CVE-2025-36889 MEDIUM
Android - Local Information Disclosure via CameraActivity Confused Deputy
CVSS 5.5
CVE-2025-48628 HIGH
PrintManagerService - Privilege Escalation
CVSS 7.8
CVE-2025-48598 MEDIUM
Face Unlock Settings - Privilege Escalation
CVSS 6.6
CVE-2025-48586 HIGH
EditFdnContactScreen - Info Disclosure
CVSS 7.8
CVE-2025-48555 HIGH
NotificationStation - Info Disclosure
CVSS 7.8
CVE-2025-48536 HIGH
SettingsSliceProvider - Privilege Escalation
CVSS 7.8
CVE-2025-22420 HIGH
Multiple Locations - Info Disclosure
CVSS 7.8
CVE-2025-66415 MEDIUM
fastify/reply-from < 12.5.0 - Unintended Proxy Access via Malicious URL
CVSS 5.4
CVE-2025-61780 MEDIUM
Rack < 2.2.20 - Proxy Request Redirection via Untrusted x-sendfile Headers
CVSS 5.8
CVE-2025-32320 HIGH
Android System UI - Unintended Proxy or Intermediary
CVSS 7.8
CVE-2025-32317 MEDIUM
Android - Information Disclosure via App Widget Confused Deputy
CVSS 5.5
CVE-2025-48560 MEDIUM
AndroidManifest.xml - Info Disclosure
CVSS 5.5
CVE-2025-48551 MEDIUM
Android - Local Information Disclosure via Confused Deputy
CVSS 5.0
Details
Vulnerabilities 92
Links
MITRE CWE Entry Search this CWE With Exploits