Weaknesses of type CWE-287

2,855 results

Falha na autenticação ou verificação insuficiente de identidade

Quando um usuário, sistema ou aplicação afirma ser alguém (ou algo), o software não valida adequadamente essa identidade antes de conceder acesso ou executar ações sensíveis. O risco é claro: um atacante se passa por outra pessoa e obtém privilégios ou dados que não deveria ter.

Example

Um app que aceita um token JWT sem verificar a assinatura, confiando apenas no nome de usuário no payload. Um atacante modifica o token para elevar seu nível de acesso e o sistema acredita, pois nunca validou a autenticidade real do token.

How to mitigate

Implemente autenticação robusta: valide credenciais em backend seguro, use protocolos padrão (OAuth 2.0, SAML, Kerberos), verifique integridade de tokens (assinatura criptográfica), implemente MFA para operações críticas e nunca confie em dados do cliente sem validação no servidor.

CVE-2026-44478HIGHhoppscotch: Unauthenticated Onboarding Config Disclosure via Empty Recovery TokenEPSS 0.2%CVE-2026-17488MEDIUMIBM i is Affected By An Improper Authentication Vulnerability in SST / DSTEPSS 0.2%CVE-2025-0663MEDIUMPotential cross-tenant account takeover vulnerability in Multiple WSO2 Products via Adaptive Authentication and Auto-LoginEPSS 0.2%CVE-2026-87292LOWVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: NetworkEPSS 0.2%CVE-2023-32453MEDIUM Dell BIOS contains an improper authentication vulnerability. A malicious user with physical access to the system may potentially exploit thEPSS 0.2%CVE-2026-25922HIGHauthentik has a Signature Verification Bypass via SAML Assertion WrappingEPSS 0.2%CVE-2021-3519MEDIUMA vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password AtEPSS 0.2%CVE-2026-105815HIGHCredential Material Exposure Leading to Unauthorized Streamed Media-Session Access in TP-Link Tapo C210EPSS 0.2%CVE-2023-21419MEDIUMAn improper implementation logic in Secure Folder prior to SMR Jan-2023 Release 1 allows the Secure Folder container remain unlocked under cEPSS 0.2%CVE-2026-40178MEDIUMajenti.plugin.core has a race conditions in 2FAEPSS 0.2%CVE-2025-24904HIGHlibsignal-service-rs doesn't sanity check plaintext envelopes are not sanity-checkedEPSS 0.2%CVE-2026-103312MEDIUMPayment Integration Wompi <= 4.0.1 - Unauthenticated Payment Confirmation Forgery via IPN CallbackEPSS 0.2%CVE-2026-105210HIGHZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init HandlersEPSS 0.2%CVE-2026-42008MEDIUMForwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a vaEPSS 0.2%CVE-2026-105213HIGHZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated OrganizationsEPSS 0.2%CVE-2022-39245HIGHMist vulnerable to user providing a Sudo binary for authentication checksEPSS 0.2%CVE-2025-2230HIGHPhilips Intellispace Cardiovascular (ISCV) Improper AuthenticationEPSS 0.2%CVE-2026-8293HIGHReally Simple Security < 9.5.10.1 - Authentication Bypass via Two-Factor OTP SkipEPSS 0.2%CVE-2024-52968MEDIUMAn improper authentication in Fortinet FortiClientMac 7.0.11 through 7.2.4 allows attacker to gain improper access to MacOS via empty passwoEPSS 0.2%CVE-2026-56294MEDIUMcapacitor-native-biometric - Authentication Bypass via Unvalidated CryptoObject in onAuthenticationSucceededEPSS 0.2%