Weaknesses of type CWE-287

2,857 results

Falha na autenticação ou verificação insuficiente de identidade

Quando um usuário, sistema ou aplicação afirma ser alguém (ou algo), o software não valida adequadamente essa identidade antes de conceder acesso ou executar ações sensíveis. O risco é claro: um atacante se passa por outra pessoa e obtém privilégios ou dados que não deveria ter.

Example

Um app que aceita um token JWT sem verificar a assinatura, confiando apenas no nome de usuário no payload. Um atacante modifica o token para elevar seu nível de acesso e o sistema acredita, pois nunca validou a autenticidade real do token.

How to mitigate

Implemente autenticação robusta: valide credenciais em backend seguro, use protocolos padrão (OAuth 2.0, SAML, Kerberos), verifique integridade de tokens (assinatura criptográfica), implemente MFA para operações críticas e nunca confie em dados do cliente sem validação no servidor.

CVE-2026-103319MEDIUMOPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Confirmation Forgery via Empty Default Secret KeyEPSS 0.2%CVE-2026-94271MEDIUMDeema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success ReturnEPSS 0.2%CVE-2026-111240—Apache TomEE: Authentication bypass for accounts without a stored password in SQL login moduleEPSS 0.2%CVE-2026-9084MEDIUMMISP OIDC authentication bypass via automatic email-based account linking under insecure IdP configurationsEPSS 0.2%CVE-2026-81740MEDIUMPaytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment CallbackEPSS 0.2%CVE-2026-103306MEDIUMiKhokha Payment Gateway < 3.0.4 - Unauthenticated Order Payment Forgery via CallbackEPSS 0.2%CVE-2026-103299MEDIUMnexi Alpha Bank for WooCommerce <= 2.2.0 - Unauthenticated Payment Confirmation Forgery via Empty Shared SecretEPSS 0.2%CVE-2022-37931HIGHA vulnerability in NetBatch-Plus software allows unauthorized access to the applicationEPSS 0.2%CVE-2023-28073HIGH Dell BIOS contains an improper authentication vulnerability. A locally authenticated malicious user may potentially exploit this vulnerabilEPSS 0.2%CVE-2022-45118MEDIUMTelephony in communication subsystem sends public events with personal data, but the permission is not set.EPSS 0.2%CVE-2026-86781MEDIUMSSL Zen < 4.7.40 - Subscriber+ TLS Private Key DisclosureEPSS 0.2%CVE-2026-112037MEDIUMdiem-project diem Google Analytics Client gapi.class.php certificate validationEPSS 0.2%CVE-2022-33862MEDIUMImproper access control mechanism in IPPEPSS 0.2%CVE-2025-22236HIGHCVE-2025-22236 salt advisoryEPSS 0.2%CVE-2025-64517MEDIUMsudo-rs doesn't record authenticating user properly in timestampEPSS 0.2%CVE-2026-95680HIGHIBM WebSphere Application Server is affected by an authorization bypassEPSS 0.2%CVE-2026-102364MEDIUMmall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin APIEPSS 0.2%CVE-2026-11717CRITICALAn authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. EPSS 0.2%CVE-2026-103332MEDIUMPayex Payment Gateway for WooCommerce <= 1.2.10 - Unauthenticated Payment Confirmation Forgery via Empty-Default Secret KeyEPSS 0.2%CVE-2026-109553HIGHGitea SSH certificate principal impersonation of other usersEPSS 0.2%