CWE-394: Unexpected Status Code or Return Value

The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.

Unexpected Status Code or Return Value is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.

Unexpected State, Alter Execution Logic

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.