Caller identity taken from an unverified header
HighAV-IDENT-002IdentityCore packNew in 2.0
What it finds
The code decides who the caller (user or agent) is from a plain X-Agent-Id / X-User-Id style header, with no signature check.
Why it matters
Anyone can set any header. Trusting it lets a caller pretend to be another user or a more privileged agent.
What an attacker could do: A caller can impersonate any user or agent.
How to fix it
Derive identity from a verified token (JWT, mTLS, signed request) and ignore identity headers from clients.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- IDENTITY_FROM_UNVERIFIED_HEADER
- How it detects
- Looks for a risky pattern, and stays quiet when a matching safeguard is present.
- Confidence
- Likely: strong signal, but review it in context.
- Scans
- Any text-based agent source or configuration (JS/TS/Python/JSON/YAML)
- OWASP LLM Top 10
- LLM08 - Excessive Agency
- NIST AI RMF
- GV-4.1
- SOC 2
- CC6.1
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.