Weaknesses of type CWE-1390

118 results

Autenticação Fraca

Mecanismos de autenticação que não verificam identidade com rigor suficiente, permitindo que atacantes se passem por usuários legítimos sem esforço significativo. Inclui senhas fracas aceitas, falta de validação adequada, ou métodos de autenticação facilmente contornáveis.

Example

Uma API que aceita login com apenas um email, sem senha ou segundo fator; ou um sistema que valida credenciais apenas no cliente (JavaScript), deixando o servidor confiar cegamente em qualquer requisição que diga estar autenticada.

How to mitigate

Implemente validação de credenciais forte no servidor (nunca no cliente), exija senhas com complexidade mínima, enforce autenticação multifator para contas sensíveis, e use protocolos padronizados (OAuth 2.0, SAML) em vez de esquemas caseiros.

CVE-2026-32497MEDIUMWordPress User Verification plugin <= 2.0.45 - Email Verification Bypass vulnerabilityEPSS 0.2%CVE-2024-5891MEDIUMQuay: unauthorized user may authenticate via oauth application tokenEPSS 0.2%CVE-2026-85328HIGHWindows Projected File System Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2025-30414HIGHLocal privilege escalation due to improper authentication. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) EPSS 0.2%CVE-2025-62844MEDIUMQuRouterEPSS 0.2%CVE-2026-27478CRITICALUnity Catalog has a JWT Issuer Validation Bypass Allows Complete User ImpersonationEPSS 0.2%CVE-2026-88101HIGHMicrosoft Input Method Editor (IME) Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2024-52541HIGHDell Client Platform BIOS contains a Weak Authentication vulnerability. A high privileged attacker with local access could potentially exploEPSS 0.2%CVE-2025-11084HIGHFactoryTalk® DataMosaix™ Private Cloud – Authentication BypassEPSS 0.2%CVE-2026-10714HIGHRockwell Automation FactoryTalk® Services Platform FTSP - Weak Authentication via JWT Validation BypassEPSS 0.1%CVE-2024-41722MEDIUMgoTenna Pro ATAK Plugin Weak AuthenticationEPSS 0.1%CVE-2024-6580LOW/n software IPWorks SSH insufficient file access verificationEPSS 0.1%CVE-2025-29991LOWYubico YubiKey 5.4.1 through 5.7.3 before 5.7.4 has an incorrect FIDO CTAP PIN/UV Auth Protocol Two implementation. It uses the signature leEPSS 0.1%CVE-2024-45551MEDIUMWeak Authentication in HLOSEPSS 0.1%CVE-2024-47127MEDIUMWeak Authentication in goTenna ProEPSS 0.1%CVE-2025-15595MEDIUMPrivilege escalation via dll hijacking in Inno SetupEPSS 0.1%CVE-2026-49323MEDIUMIndian Scout Bobber 2025 WCM-to-ECM weak authenticationEPSS 0.1%CVE-2026-49322MEDIUMIndian Scout Bobber 2025 Infotainment-to-WCM weak authentication allows recovery of user PIN from observed exchangeEPSS 0.1%