Weaknesses of type CWE-287

2,857 results

Falha na autenticação ou verificação insuficiente de identidade

Quando um usuário, sistema ou aplicação afirma ser alguém (ou algo), o software não valida adequadamente essa identidade antes de conceder acesso ou executar ações sensíveis. O risco é claro: um atacante se passa por outra pessoa e obtém privilégios ou dados que não deveria ter.

Example

Um app que aceita um token JWT sem verificar a assinatura, confiando apenas no nome de usuário no payload. Um atacante modifica o token para elevar seu nível de acesso e o sistema acredita, pois nunca validou a autenticidade real do token.

How to mitigate

Implemente autenticação robusta: valide credenciais em backend seguro, use protocolos padrão (OAuth 2.0, SAML, Kerberos), verifique integridade de tokens (assinatura criptográfica), implemente MFA para operações críticas e nunca confie em dados do cliente sem validação no servidor.

CVE-2022-48314MEDIUMThe Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploitation of this vulnerabEPSS 0.2%CVE-2026-110285MEDIUMWP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing SecretEPSS 0.2%CVE-2026-6729MEDIUMHKUDS OpenHarness Session Key Collision Privilege EscalationEPSS 0.2%CVE-2023-2638MEDIUMRockwell Automation FactoryTalk System Services Vulnerable to a Denial-of-Service AttackEPSS 0.2%CVE-2021-25506MEDIUMNon-existent provider in Samsung Health prior to 6.19.1.0001 allows attacker to access it via malicious content provider or lead to denial oEPSS 0.2%CVE-2026-113469HIGHImproper Signature Verification of Active Update FilesEPSS 0.2%CVE-2026-103651HIGHMISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication BypassEPSS 0.2%CVE-2026-118959MEDIUMKeycloak-services: keycloak-services: required actions bypassed via kc_action parameterEPSS 0.2%CVE-2026-33314MEDIUMpyload-ng: Improper Authentication and Origin Validation ErrorEPSS 0.2%CVE-2026-91078HIGHTillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PINEPSS 0.2%CVE-2023-31015MEDIUMNVIDIA DGX H100 BMC contains a vulnerability in the REST service where a host user may cause as improper authentication issue. A successful EPSS 0.2%CVE-2026-34389MEDIUMFleet's user account creation via invite does not enforce invited email addressEPSS 0.2%CVE-2021-33159HIGHImproper authentication in subsystem for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may alEPSS 0.2%CVE-2025-37731MEDIUMElasticsearch Improper AuthenticationEPSS 0.2%CVE-2023-3028HIGHImproper backend communication allows access and manipulation of the telemetry dataEPSS 0.2%CVE-2026-20752MEDIUMImproper authentication for some Intel(R) PROSet/Wireless WiFi Software within Ring 0: Kernel may allow an information disclosure. System soEPSS 0.2%CVE-2026-114443HIGHSecurity by CleanTalk < 2.191 - Unauthenticated Authentication Bypass via Authenticator App CodeEPSS 0.2%CVE-2025-0217HIGHPrivileged Remote Access Authentication BypassEPSS 0.2%CVE-2026-20683HIGHAn authentication issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macEPSS 0.2%CVE-2026-91467MEDIUMVulnerability in the Oracle Fusion Middleware Control product of Oracle Fusion Middleware (component: Framework). Supported versions that aEPSS 0.2%