Weaknesses of type CWE-287

2,856 results

Falha na autenticação ou verificação insuficiente de identidade

Quando um usuário, sistema ou aplicação afirma ser alguém (ou algo), o software não valida adequadamente essa identidade antes de conceder acesso ou executar ações sensíveis. O risco é claro: um atacante se passa por outra pessoa e obtém privilégios ou dados que não deveria ter.

Example

Um app que aceita um token JWT sem verificar a assinatura, confiando apenas no nome de usuário no payload. Um atacante modifica o token para elevar seu nível de acesso e o sistema acredita, pois nunca validou a autenticidade real do token.

How to mitigate

Implemente autenticação robusta: valide credenciais em backend seguro, use protocolos padrão (OAuth 2.0, SAML, Kerberos), verifique integridade de tokens (assinatura criptográfica), implemente MFA para operações críticas e nunca confie em dados do cliente sem validação no servidor.

CVE-2026-55962MEDIUMTLS 1.3 post-handshake authentication: server accepts Finished without client Certificate/CertificateVerifyEPSS 0.2%CVE-2026-56294MEDIUMcapacitor-native-biometric - Authentication Bypass via Unvalidated CryptoObject in onAuthenticationSucceededEPSS 0.2%CVE-2026-49194CRITICALSCREEN_CLICK Authentication BypassEPSS 0.2%CVE-2026-79875CRITICALAuthentication Bypass in the PAPI Protocol of AOS-8 Allows Unauthorized Administrative AccessEPSS 0.2%CVE-2025-27425MEDIUMQR code user confirmation bypass with invalid protocolEPSS 0.2%CVE-2026-126129—The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-oEPSS 0.2%CVE-2026-115996MEDIUMUnitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validationEPSS 0.2%CVE-2026-105305MEDIUMKeycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcementEPSS 0.2%CVE-2022-22284MEDIUMImproper authentication vulnerability in Samsung Internet prior to 16.0.2.19 allows attackers to bypass secret mode password authenticationEPSS 0.2%CVE-2026-103331MEDIUMUniPAY Payment Gateway For WooCommerce < 2.4 - Unauthenticated Order Payment Forgery via Empty IPN SecretEPSS 0.2%CVE-2026-93489HIGHImproper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subEPSS 0.2%CVE-2026-123091HIGHVigilant < 2.11.0 - 2FA Bypass via Third-Party Login FormsEPSS 0.2%CVE-2020-36548MEDIUMGE Voluson S8 Service Browser users.cgi improper authenticationEPSS 0.2%CVE-2026-118201HIGHLimit Login Attempts Reloaded 3.0.0 - 3.4.0 - Two-Factor Authentication Bypass via XML-RPCEPSS 0.2%CVE-2025-53013MEDIUMHimmelblau offline auth permits authentication with invalid Hello PINEPSS 0.2%CVE-2023-28646MEDIUMApp lockout in nextcloud Android app can be bypassed via thirdparty appsEPSS 0.2%CVE-2021-25451LOWA PendingIntent hijacking in NetworkPolicyManagerService prior to SMR Sep-2021 Release 1 allows attackers to get IMSI data.EPSS 0.2%CVE-2026-57175MEDIUMsocial-auth-core has an Improper Authentication issueEPSS 0.2%CVE-2026-32804HIGHDell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with aEPSS 0.2%CVE-2026-111250—Apache TomEE: Authentication bypass via programmatic authentication in embedded HTTP serverEPSS 0.2%