Weaknesses of type CWE-287

2,850 results

Falha na autenticação ou verificação insuficiente de identidade

Quando um usuário, sistema ou aplicação afirma ser alguém (ou algo), o software não valida adequadamente essa identidade antes de conceder acesso ou executar ações sensíveis. O risco é claro: um atacante se passa por outra pessoa e obtém privilégios ou dados que não deveria ter.

Example

Um app que aceita um token JWT sem verificar a assinatura, confiando apenas no nome de usuário no payload. Um atacante modifica o token para elevar seu nível de acesso e o sistema acredita, pois nunca validou a autenticidade real do token.

How to mitigate

Implemente autenticação robusta: valide credenciais em backend seguro, use protocolos padrão (OAuth 2.0, SAML, Kerberos), verifique integridade de tokens (assinatura criptográfica), implemente MFA para operações críticas e nunca confie em dados do cliente sem validação no servidor.

CVE-2024-23471CRITICALSolarWinds Access Rights Manager (ARM) CreateFile Directory Traversal Remote Code Execution VulnerabilityEPSS 1.3%CVE-2021-38412CRITICALDigi PortServer TS 16 Improper AuthenticationEPSS 1.3%CVE-2019-3798MEDIUMEscalation of Privileges in Cloud ControllerEPSS 1.3%CVE-2019-10966—In GE Aestiva and Aespire versions 7100 and 7900, a vulnerability exists where serial devices are connected via an added unsecured terminal EPSS 1.3%CVE-2026-78168CRITICALEFM ipTIME T24000M Session Validation httpcon_check_session_url improper authenticationEPSS 1.3%CVE-2026-19977CRITICALEFM ipTIME A3004T Session Validation httpcon_check_session_url improper authenticationEPSS 1.3%CVE-2016-0796—WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and EPSS 1.3%CVE-2008-3738CRITICALSession fixation vulnerability in SpaceTag LacoodaST 2.1.3 and earlier allows remote attackers to hijack web sessions via unspecified vectorEPSS 1.3%CVE-2020-8200—Improper authentication in Citrix StoreFront Server < 1912.0.1000 allows an attacker who is authenticated on the same Microsoft Active DirecEPSS 1.3%CVE-2021-41265HIGHImproper Authentication in Flask-AppBuilderEPSS 1.3%CVE-2026-22594HIGHGhost has Staff 2FA bypassEPSS 1.3%CVE-2022-2553—The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a resulEPSS 1.3%CVE-2026-1368HIGHVideo Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature GenerationEPSS 1.3%CVE-2020-14494—OpenClinic GA versions 5.09.02 and 5.89.05b contain an authentication mechanism within the system that does not provide sufficient complexitEPSS 1.3%CVE-2019-12254CRITICALTECSON/GOK: Improper Authentication and Access Control on multiple devicesEPSS 1.3%CVE-2022-38744HIGHFactoryTalk Alarm and Events Server Vulnerable to Denial-Of-Service AttackEPSS 1.3%CVE-2022-46146MEDIUMPrometheus Exporter Toolkit vulnerable to basic authentication bypassEPSS 1.3%CVE-2020-27254—Emerson Rosemount X-STREAM Gas AnalyzerX-STREAM enhanced XEGP, XEGK, XEFD, XEXF – all revisions, The affected products are vulnerable to impEPSS 1.3%CVE-2024-38099MEDIUMWindows Remote Desktop Licensing Service Denial of Service VulnerabilityEPSS 1.3%CVE-2022-46145HIGHauthentik vulnerable to unauthorized user creation and potential account takeoverEPSS 1.3%