Weaknesses of type CWE-287

2,855 results

Falha na autenticação ou verificação insuficiente de identidade

Quando um usuário, sistema ou aplicação afirma ser alguém (ou algo), o software não valida adequadamente essa identidade antes de conceder acesso ou executar ações sensíveis. O risco é claro: um atacante se passa por outra pessoa e obtém privilégios ou dados que não deveria ter.

Example

Um app que aceita um token JWT sem verificar a assinatura, confiando apenas no nome de usuário no payload. Um atacante modifica o token para elevar seu nível de acesso e o sistema acredita, pois nunca validou a autenticidade real do token.

How to mitigate

Implemente autenticação robusta: valide credenciais em backend seguro, use protocolos padrão (OAuth 2.0, SAML, Kerberos), verifique integridade de tokens (assinatura criptográfica), implemente MFA para operações críticas e nunca confie em dados do cliente sem validação no servidor.

CVE-2026-33512HIGHAVideo has an unauthenticated decrypt oracle leaking any ciphertextEPSS 0.2%CVE-2026-44166MEDIUMPocketbase: Account pre-hijacking via OAuth2 unverfied->verified autolinking upgradeEPSS 0.2%CVE-2026-0407MEDIUMAuthentication bypass in NETGEAR WiFi Range Extenders via network adjacent attacksEPSS 0.2%CVE-2020-12035—Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The PrismaFlex device contains a hard-coded service password that provideEPSS 0.2%CVE-2026-96456MEDIUMReachy Mini Bluetooth PIN authentication can be bypassed by racing an authenticated deviceEPSS 0.2%CVE-2025-62398MEDIUMMoodle: possible to bypass mfaEPSS 0.2%CVE-2026-79873CRITICALUnauthenticated Adjacent Authentication Bypasses in the PAPI Protocol of AOS-10 Leads to Unauthorized Administrative AccessEPSS 0.2%CVE-2026-79874CRITICALAuthentication Bypass in the API allows Administrative Access of AOS-10EPSS 0.2%CVE-2026-56727HIGHZammad: PGP signature spoofing via unvalidated verification returnEPSS 0.2%CVE-2026-118202HIGHLimit Login Attempts Reloaded < 3.4.1 - Two-Factor Authentication Bypass via Malformed X-Forwarded-For HeaderEPSS 0.2%CVE-2026-22764MEDIUMDell OpenManage Network Integration, versions prior to 3.9, contains an Improper Authentication vulnerability. A low privileged attacker witEPSS 0.2%CVE-2026-45567HIGHRoxy-WI: Authentication bypass via 'api' substring in URL + unauthenticated /api/gptEPSS 0.2%CVE-2026-39322CRITICALPolarLearn: Any password authenticates banned accounts and grants API accessEPSS 0.2%CVE-2026-111955MEDIUMWholesaleX < 3.0.9 - Unauthenticated Account Activation and Administrator Approval BypassEPSS 0.2%CVE-2026-65329MEDIUMAn authentication issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, iOS 27 and iPadOSEPSS 0.2%CVE-2026-46437MEDIUMwger: API credentials remain valid after logout/password changeEPSS 0.2%CVE-2024-24554MEDIUMBludit - Insecure Token GenerationEPSS 0.2%CVE-2025-9265CRITICALAPI Authentication Bypass via Header Spoofing vulnerability in Kiloview NDI N30 ProductsEPSS 0.2%CVE-2025-15484CRITICALOrder Notification for WooCommerce < 3.6.3 - Unauthenticated WooCommerce REST Permission BypassEPSS 0.2%CVE-2021-3458MEDIUMThe Motorola MM1000 device configuration portal can be accessed without authentication, which could allow adapter settings to be modified.EPSS 0.2%