Weaknesses of type CWE-287

2,850 results

Falha na autenticação ou verificação insuficiente de identidade

Quando um usuário, sistema ou aplicação afirma ser alguém (ou algo), o software não valida adequadamente essa identidade antes de conceder acesso ou executar ações sensíveis. O risco é claro: um atacante se passa por outra pessoa e obtém privilégios ou dados que não deveria ter.

Example

Um app que aceita um token JWT sem verificar a assinatura, confiando apenas no nome de usuário no payload. Um atacante modifica o token para elevar seu nível de acesso e o sistema acredita, pois nunca validou a autenticidade real do token.

How to mitigate

Implemente autenticação robusta: valide credenciais em backend seguro, use protocolos padrão (OAuth 2.0, SAML, Kerberos), verifique integridade de tokens (assinatura criptográfica), implemente MFA para operações críticas e nunca confie em dados do cliente sem validação no servidor.

CVE-2020-11020HIGHAuthentication and extension bypass in FayeEPSS 1.6%CVE-2014-5412—Schneider Electric SCADA Expert ClearSCADA Improper AuthenticationEPSS 1.6%CVE-2022-39042CRITICALaEnrich a+HRD - Improper AuthenticationEPSS 1.6%CVE-2022-20798CRITICALCisco Email Security Appliance and Cisco Secure Email and Web Manager External Authentication Bypass VulnerabilityEPSS 1.6%CVE-2007-4043CRITICALfile.cgi in Secure Computing SecurityReporter (aka Network Security Analyzer) before 4.6.3 allows remote attackers to bypass authentication EPSS 1.6%CVE-2017-6711—A vulnerability in the Ultra Automation Service (UAS) of the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker EPSS 1.6%CVE-2022-43504MEDIUMImproper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email addrEPSS 1.6%CVE-2022-37914CRITICALVulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attEPSS 1.5%CVE-2022-37913CRITICALVulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attEPSS 1.5%CVE-2018-12472HIGHAuthentication bypass in sibling checkEPSS 1.5%CVE-2024-21427HIGHWindows Kerberos Security Feature Bypass VulnerabilityEPSS 1.5%CVE-2020-36533LOWKlapp App JSON Web Token improper authenticationEPSS 1.5%CVE-2022-31013CRITICALAuthentication bypass in Vartalap chat-serverEPSS 1.5%CVE-2024-27834MEDIUMThe issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, maEPSS 1.5%KEVCVE-2022-22935LOWAn issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MEPSS 1.5%CVE-2021-21538CRITICALDell EMC iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.10.00, contain an improper authentication vulnerability. A remote unauthentEPSS 1.5%CVE-2021-3652—A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inEPSS 1.5%CVE-2026-78167CRITICALEFM ipTIME T16000M Session Validation httpcon_check_session_url improper authenticationEPSS 1.5%CVE-2023-29463HIGHPavilion8 Security Misconfiguration VulnerabilityEPSS 1.5%CVE-2025-1723HIGHAccount takeoverEPSS 1.5%