Weaknesses of type CWE-1390

95 results

Autenticação Fraca

Mecanismos de autenticação que não verificam identidade com rigor suficiente, permitindo que atacantes se passem por usuários legítimos sem esforço significativo. Inclui senhas fracas aceitas, falta de validação adequada, ou métodos de autenticação facilmente contornáveis.

Example

Uma API que aceita login com apenas um email, sem senha ou segundo fator; ou um sistema que valida credenciais apenas no cliente (JavaScript), deixando o servidor confiar cegamente em qualquer requisição que diga estar autenticada.

How to mitigate

Implemente validação de credenciais forte no servidor (nunca no cliente), exija senhas com complexidade mínima, enforce autenticação multifator para contas sensíveis, e use protocolos padronizados (OAuth 2.0, SAML) em vez de esquemas caseiros.

CVE-2024-54092CRITICALA vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (AlEPSS 0.7%CVE-2025-23058HIGHAuthenticated Broken Access Control Vulnerability in ClearPass Policy Manager Web-Based Management InterfaceEPSS 0.7%CVE-2026-62895HIGHAzure Arc SQL Server Extension Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2023-41862MEDIUMWordPress VS Contact Form plugin <= 14.0 - Sum Captcha Bypass vulnerabilityEPSS 0.7%CVE-2025-30412CRITICALSensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (LiEPSS 0.7%CVE-2024-0822HIGHOvirt: authentication bypassEPSS 0.7%CVE-2026-65098HIGHNVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an attacker could cause weak authentication. EPSS 0.7%CVE-2025-47995MEDIUMAzure Machine Learning Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2025-1727HIGHEnd-of-Train and Head-of-Train Remote Linking Protocol Weak AuthenticationEPSS 0.6%CVE-2023-53894CRITICALphpfm 1.7.9 Authentication Bypass via Type Juggling VulnerabilityEPSS 0.6%CVE-2025-12870CRITICALaEnrich｜eHRD - Authentication AbuseEPSS 0.6%CVE-2025-7326HIGHEOL ASP.NET Core Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2025-39596CRITICALWordPress Quentn WP plugin <= 1.2.8 - Privilege Escalation VulnerabilityEPSS 0.6%CVE-2025-1387CRITICALLearning Digital Orca HCM - Improper AuthenticationEPSS 0.6%CVE-2025-12871CRITICALaEnrich｜a+HRD - Authentication AbuseEPSS 0.6%CVE-2025-49201HIGHA weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all veEPSS 0.6%CVE-2024-50563MEDIUMA weak authentication in Fortinet FortiManager Cloud, FortiAnalyzer versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiAnalyzer Cloud vEPSS 0.6%CVE-2024-36787HIGHAn issue in Netgear WNR614 JNR1010V2 N300-V1.1.0.54_1.0.1 allows attackers to bypass authentication and access the administrative interface EPSS 0.6%CVE-2024-13239CRITICALTwo-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003EPSS 0.6%CVE-2025-31676HIGHEmail TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001EPSS 0.6%