Weaknesses of type CWE-287

2,856 results

Falha na autenticação ou verificação insuficiente de identidade

Quando um usuário, sistema ou aplicação afirma ser alguém (ou algo), o software não valida adequadamente essa identidade antes de conceder acesso ou executar ações sensíveis. O risco é claro: um atacante se passa por outra pessoa e obtém privilégios ou dados que não deveria ter.

Example

Um app que aceita um token JWT sem verificar a assinatura, confiando apenas no nome de usuário no payload. Um atacante modifica o token para elevar seu nível de acesso e o sistema acredita, pois nunca validou a autenticidade real do token.

How to mitigate

Implemente autenticação robusta: valide credenciais em backend seguro, use protocolos padrão (OAuth 2.0, SAML, Kerberos), verifique integridade de tokens (assinatura criptográfica), implemente MFA para operações críticas e nunca confie em dados do cliente sem validação no servidor.

CVE-2026-94256HIGHSMS Alert 4.0.0 - Unauthenticated Authentication Bypass via Login with OTPEPSS 0.2%CVE-2026-49454CRITICALRelyra SAML SignatureValue not cryptographically verified -> authentication bypassEPSS 0.2%CVE-2026-96447MEDIUMKeycloak-services: keycloak-services: stateless token preferred_username fallback enables identity rebindingEPSS 0.2%CVE-2026-106015HIGHEcommerce Affiliate <= 1.0.0 - Unauthenticated Account Takeover via Email OTP Brute ForceEPSS 0.2%CVE-2026-97880—Apache TomEE: Authentication bypass in the embedded HTTP server for endpoints protected by HTTP Basic authenticationEPSS 0.2%CVE-2026-43674MEDIUMAn authentication issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27. An attacker with physicalEPSS 0.2%CVE-2021-25343MEDIUMCalling of non-existent provider in Samsung Members prior to version 2.4.81.13 (in Android O(8.1) and below) and 3.8.00.13 (in Android P(9.0EPSS 0.2%CVE-2021-25341MEDIUMCalling of non-existent provider in S Assistant prior to version 6.5.01.22 allows unauthorized actions including denial of service attack byEPSS 0.2%CVE-2021-25342MEDIUMCalling of non-existent provider in SMP sdk prior to version 3.0.9 allows unauthorized actions including denial of service attack by hijackiEPSS 0.2%CVE-2023-42935MEDIUMAn authentication issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.6.4. A local attacker may be aEPSS 0.2%CVE-2022-25825MEDIUMImproper access control vulnerability in Samsung Account prior to version 13.1.0.1 allows attackers to access to the authcode for sign-in.EPSS 0.2%CVE-2025-52294MEDIUMInsufficient validation of the screen lock mechanism in Trust Wallet v8.45 allows physically proximate attackers to bypass the lock screen aEPSS 0.2%CVE-2025-10672HIGHwhuan132 AIBattery com.collweb.AIBatteryHelper BatteryXPCService.swift missing authenticationEPSS 0.2%CVE-2026-81703HIGHopenssl_encrypt before 1.4.9 Authentication Bypass via Unencrypted PQC KeyEPSS 0.2%CVE-2026-90862MEDIUMWeb Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP ServerEPSS 0.2%CVE-2026-42602HIGHazureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replayEPSS 0.2%CVE-2025-11130HIGHiHongRen pptp-vpn XPC Service HelperTool.m shouldAcceptNewConnection missing authenticationEPSS 0.2%CVE-2026-107120MEDIUMContest Gallery < 33.0.1 - Unauthenticated Email Verification Bypass via Brute-Forceable Registration PINEPSS 0.2%CVE-2025-29906HIGHFinit bundled getty can bypass /bin/loginEPSS 0.2%CVE-2026-101269LOWIncorrect session validation for API-uploaded filesEPSS 0.2%