Weaknesses of type CWE-287

2,858 results

Falha na autenticação ou verificação insuficiente de identidade

Quando um usuário, sistema ou aplicação afirma ser alguém (ou algo), o software não valida adequadamente essa identidade antes de conceder acesso ou executar ações sensíveis. O risco é claro: um atacante se passa por outra pessoa e obtém privilégios ou dados que não deveria ter.

Example

Um app que aceita um token JWT sem verificar a assinatura, confiando apenas no nome de usuário no payload. Um atacante modifica o token para elevar seu nível de acesso e o sistema acredita, pois nunca validou a autenticidade real do token.

How to mitigate

Implemente autenticação robusta: valide credenciais em backend seguro, use protocolos padrão (OAuth 2.0, SAML, Kerberos), verifique integridade de tokens (assinatura criptográfica), implemente MFA para operações críticas e nunca confie em dados do cliente sem validação no servidor.

CVE-2026-1568CRITICALRapid7 InsightVM Signature Validation VulnerabilityEPSS 0.2%CVE-2025-32875MEDIUMAn issue was discovered in the COROS application through 3.8.12 for Android. Bluetooth pairing and bonding is neither initiated nor enforcedEPSS 0.2%CVE-2022-36370HIGHImproper authentication in BIOS firmware for some Intel(R) NUC Boards and Intel(R) NUC Kits before version MYi30060 may allow a privileged uEPSS 0.2%CVE-2026-88928MEDIUMPAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification BypassEPSS 0.2%CVE-2025-65431MEDIUMAn issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-partEPSS 0.2%CVE-2025-20083HIGHImproper authentication in the firmware for the Intel(R) Slim Bootloader may allow a privileged user to potentially enable escalation of priEPSS 0.2%CVE-2026-110013MEDIUMSalon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-TokenEPSS 0.2%CVE-2025-26475MEDIUMDell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.26, Enables Live-Restore setting which enhances security by keeping contEPSS 0.2%CVE-2025-48909HIGHBypass vulnerability in the device management channel Impact: Successful exploitation of this vulnerability may affect service confidentialiEPSS 0.2%CVE-2024-4601MEDIUMImproper Authentication vulnerability in Socomec Net VisionEPSS 0.2%CVE-2022-48575LOWA person with access to a Mac may be able to bypass Login Window. A consistency issue was addressed with improved state handling. This issueEPSS 0.2%CVE-2024-9133MEDIUMA user with administrator privileges is able to retrieve authentication tokensEPSS 0.2%CVE-2026-57178HIGHsocial-auth-core: VK App backend accepts unsigned callback data when auth_key is missingEPSS 0.2%CVE-2024-38825MEDIUMCVE-2024-38825 Salt AdvisoryEPSS 0.2%CVE-2026-114438MEDIUMKeycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action orderingEPSS 0.2%CVE-2021-3784MEDIUMGaruda Linux Improper AuthorizationEPSS 0.2%CVE-2021-25430—Improper access control vulnerability in Bluetooth application prior to SMR July-2021 Release 1 allows untrusted application to access the BEPSS 0.2%CVE-2023-21460MEDIUMImproper authentication in SecSettings prior to SMR Mar-2023 Release 1 allows attacker to reset the setting.EPSS 0.2%CVE-2026-97846MEDIUMKeycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key bindingEPSS 0.2%CVE-2024-36266HIGHA vulnerability has been identified in PowerSys (All versions < V3.11). The affected application insufficiently protects responses to authenEPSS 0.2%