Weaknesses of type CWE-287

2,849 results

Falha na autenticação ou verificação insuficiente de identidade

Quando um usuário, sistema ou aplicação afirma ser alguém (ou algo), o software não valida adequadamente essa identidade antes de conceder acesso ou executar ações sensíveis. O risco é claro: um atacante se passa por outra pessoa e obtém privilégios ou dados que não deveria ter.

Example

Um app que aceita um token JWT sem verificar a assinatura, confiando apenas no nome de usuário no payload. Um atacante modifica o token para elevar seu nível de acesso e o sistema acredita, pois nunca validou a autenticidade real do token.

How to mitigate

Implemente autenticação robusta: valide credenciais em backend seguro, use protocolos padrão (OAuth 2.0, SAML, Kerberos), verifique integridade de tokens (assinatura criptográfica), implemente MFA para operações críticas e nunca confie em dados do cliente sem validação no servidor.

CVE-2025-26326HIGHA vulnerability was identified in the NVDA Remote (version 2.6.4) and Tele NVDA Remote (version 2025.3.3) remote connection add-ons, which aEPSS 1.7%CVE-2019-20464HIGHAn issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. By default, a mobile application is used to strEPSS 1.7%CVE-2018-5387—Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be aEPSS 1.7%CVE-2021-21335MEDIUMBasic Authentication can be bypassed using a malformed usernameEPSS 1.7%CVE-2022-23635HIGHUnauthenticated control plane denial of service attack in IstioEPSS 1.7%CVE-2020-15136MEDIUMImproper authentication in etcdEPSS 1.7%CVE-2019-14856MEDIUMansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a NoneEPSS 1.6%CVE-2022-45922HIGHAn issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The request handler for ll.KeepAliveSession sets a valid AdmEPSS 1.6%CVE-2019-15585—Improper authentication exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) in the GitEPSS 1.6%CVE-2018-3761—Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing checks potentially allowEPSS 1.6%CVE-2021-21329HIGHMulti Factor Authentication Token Improperly Validated On User LoginEPSS 1.6%CVE-2019-18341MEDIUMA vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The SFTP service (default port 22/tcp) of the CoEPSS 1.6%CVE-2025-55241CRITICALAzure Entra ID Elevation of Privilege VulnerabilityEPSS 1.6%CVE-2018-3822—X-Pack Security versions 6.2.0, 6.2.1, and 6.2.2 are vulnerable to a user impersonation attack via incorrect XML canonicalization and DOM trEPSS 1.6%CVE-2022-2197CRITICALExemys RME1EPSS 1.6%CVE-2019-15987MEDIUMCisco WebEx Centers Username Enumeration Information Disclosure VulnerabilityEPSS 1.6%CVE-2019-18287—A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). The Application Server exposes EPSS 1.6%CVE-2019-18286—A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). The Application Server exposes EPSS 1.6%CVE-2022-28321CRITICALThe Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn'tEPSS 1.6%CVE-2021-44759—Improper authentication vulnerability in TLS origin verificationEPSS 1.6%