Weaknesses of type CWE-287

2,855 results

Falha na autenticação ou verificação insuficiente de identidade

Quando um usuário, sistema ou aplicação afirma ser alguém (ou algo), o software não valida adequadamente essa identidade antes de conceder acesso ou executar ações sensíveis. O risco é claro: um atacante se passa por outra pessoa e obtém privilégios ou dados que não deveria ter.

Example

Um app que aceita um token JWT sem verificar a assinatura, confiando apenas no nome de usuário no payload. Um atacante modifica o token para elevar seu nível de acesso e o sistema acredita, pois nunca validou a autenticidade real do token.

How to mitigate

Implemente autenticação robusta: valide credenciais em backend seguro, use protocolos padrão (OAuth 2.0, SAML, Kerberos), verifique integridade de tokens (assinatura criptográfica), implemente MFA para operações críticas e nunca confie em dados do cliente sem validação no servidor.

CVE-2025-3634MEDIUMMoodle: moodle allows course self-enrolment before completing mfaEPSS 0.3%CVE-2025-31264MEDIUMAn authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS EPSS 0.3%CVE-2026-44547CRITICALChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2EPSS 0.3%CVE-2026-119980MEDIUMUsersWP <= 1.2.78 - Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form HashEPSS 0.3%CVE-2024-13309MEDIUMLogin Disable - Critical - Access bypass - SA-CONTRIB-2024-073EPSS 0.3%CVE-2026-55369MEDIUMWaline login accepts a non-string email as a match-all MongoDB queryEPSS 0.3%CVE-2026-52749MEDIUMImproper Authentication in Kaon AR2140XEPSS 0.3%CVE-2026-44810HIGHMicrosoft Cryptographic Services Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-105814MEDIUMOrder-Dependent Authentication Bypass in the DS JSON API in TP-Link Tapo C210EPSS 0.3%CVE-2025-11633MEDIUMTomofun Furbo 360/Furbo Mini HTTP Traffic collect_logs.sh upload_file_to_s3 certificate validationEPSS 0.3%CVE-2026-17013MEDIUMWP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstartEPSS 0.3%CVE-2026-73726MEDIUMAuthentication Bypass in HPE Networking Fabric Composer allows Unauthorized Administrative AccessEPSS 0.3%CVE-2026-41720HIGHAuthentication Bypass with Empty Password in Spring LDAPEPSS 0.3%CVE-2026-49202HIGHUnverified Meeting Recording Endpoints & Permissive CORSEPSS 0.3%CVE-2026-33124HIGHFrigate has insecure password change functionalityEPSS 0.3%CVE-2026-34834HIGHBulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validationEPSS 0.3%CVE-2023-43551CRITICALImproper Authentication in Multi-Mode Call ProcessorEPSS 0.3%CVE-2025-6083MEDIUMExtremeCloud Universal ZTNA Improper AuthorizationEPSS 0.3%CVE-2025-65925MEDIUMAn issue was discovered in Zeroheight (SaaS) prior to 2025-06-13. A legacy user creation API pathway allowed accounts to be created without EPSS 0.3%CVE-2026-40946CRITICALOxia: OIDC token audience validation bypass via SkipClientIDCheckEPSS 0.3%