Weaknesses of type CWE-1390

119 results

Autenticação Fraca

Mecanismos de autenticação que não verificam identidade com rigor suficiente, permitindo que atacantes se passem por usuários legítimos sem esforço significativo. Inclui senhas fracas aceitas, falta de validação adequada, ou métodos de autenticação facilmente contornáveis.

Example

Uma API que aceita login com apenas um email, sem senha ou segundo fator; ou um sistema que valida credenciais apenas no cliente (JavaScript), deixando o servidor confiar cegamente em qualquer requisição que diga estar autenticada.

How to mitigate

Implemente validação de credenciais forte no servidor (nunca no cliente), exija senhas com complexidade mínima, enforce autenticação multifator para contas sensíveis, e use protocolos padronizados (OAuth 2.0, SAML) em vez de esquemas caseiros.

CVE-2025-59249HIGHMicrosoft Exchange Server Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2026-62895HIGHAzure Arc SQL Server Extension Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2025-47995MEDIUMAzure Machine Learning Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2026-77483HIGHSQL Server Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2025-30411CRITICALSensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (LiEPSS 0.8%CVE-2024-54092CRITICALA vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (AlEPSS 0.8%CVE-2024-34451CRITICALGhost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headeEPSS 0.8%CVE-2025-23058HIGHAuthenticated Broken Access Control Vulnerability in ClearPass Policy Manager Web-Based Management InterfaceEPSS 0.7%CVE-2026-83674HIGHActive Directory Federation Services (AD FS) Spoofing VulnerabilityEPSS 0.7%CVE-2025-7326HIGHEOL ASP.NET Core Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2024-0822HIGHOvirt: authentication bypassEPSS 0.7%CVE-2023-41862MEDIUMWordPress VS Contact Form plugin <= 14.0 - Sum Captcha Bypass vulnerabilityEPSS 0.7%CVE-2025-30412CRITICALSensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (LiEPSS 0.7%CVE-2025-12870CRITICALaEnrich｜eHRD - Authentication AbuseEPSS 0.7%CVE-2026-83511HIGHActive Directory Federation Services (AD FS) Spoofing VulnerabilityEPSS 0.7%CVE-2026-69982MEDIUMActive Directory Federation Services (AD FS) Security Feature Bypass VulnerabilityEPSS 0.6%CVE-2025-1727HIGHEnd-of-Train and Head-of-Train Remote Linking Protocol Weak AuthenticationEPSS 0.6%CVE-2026-70005MEDIUMActive Directory Federation Services (AD FS) Security Feature Bypass VulnerabilityEPSS 0.6%CVE-2026-69802HIGHNetwork Device Enrollment Service (NDES) Remote Code Execution VulnerabilityEPSS 0.6%CVE-2023-53894CRITICALphpfm 1.7.9 Authentication Bypass via Type Juggling VulnerabilityEPSS 0.6%