Weaknesses of type CWE-287

2,850 results

Falha na autenticação ou verificação insuficiente de identidade

Quando um usuário, sistema ou aplicação afirma ser alguém (ou algo), o software não valida adequadamente essa identidade antes de conceder acesso ou executar ações sensíveis. O risco é claro: um atacante se passa por outra pessoa e obtém privilégios ou dados que não deveria ter.

Example

Um app que aceita um token JWT sem verificar a assinatura, confiando apenas no nome de usuário no payload. Um atacante modifica o token para elevar seu nível de acesso e o sistema acredita, pois nunca validou a autenticidade real do token.

How to mitigate

Implemente autenticação robusta: valide credenciais em backend seguro, use protocolos padrão (OAuth 2.0, SAML, Kerberos), verifique integridade de tokens (assinatura criptográfica), implemente MFA para operações críticas e nunca confie em dados do cliente sem validação no servidor.

CVE-2021-28174MEDIUMMitake Smart Stock Selection System - Broken AuthenticationEPSS 1.0%CVE-2023-7210HIGHOneNav API improper authenticationEPSS 1.0%CVE-2026-75429CRITICALPowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the SeEPSS 1.0%CVE-2025-58060HIGHcups has Authentication bypass with AuthType NegotiateEPSS 1.0%CVE-2025-27112MEDIUMNavidrome has authentication bypass in Subsonic API with non-existent usernameEPSS 1.0%CVE-2023-6768CRITICALAuthentication bypass vulnerability in Amazing Little PollEPSS 1.0%CVE-2013-10004MEDIUMTelecommunication Software SAMwin Contact Center Suite Password SAMwinLIBVB.dll passwordScramble improper authenticationEPSS 1.0%CVE-2017-20237CRITICALHirschmann Industrial HiVision Authentication Bypass Remote Code ExecutionEPSS 1.0%CVE-2022-39355CRITICALDiscourse Patreon vulnerable to improper validation of email during Patreon authenticationEPSS 1.0%CVE-2026-121933CRITICALLinksys E5350 Setup Wizard apply.cgi save_settings missing authenticationEPSS 1.0%CVE-2026-76187CRITICALApache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWTEPSS 1.0%CVE-2024-0988MEDIUMSichuan Yougou Technology KuERP common.php checklogin improper authenticationEPSS 1.0%CVE-2021-38686HIGHImproper Authentication Vulnerability in VioStorEPSS 1.0%CVE-2026-58399HIGH@acastellon/auth has an authentication bypass via spoofable headers in validateToken()EPSS 1.0%CVE-2024-10511MEDIUMCWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someone on the local netwoEPSS 1.0%CVE-2021-4230LOWAirfield Online MySQL Backup improper authenticationEPSS 1.0%CVE-2023-22303CRITICALTP-Link SG105PE firmware prior to 'TL-SG105PE(UN) 1.0_1.0.0 Build 20221208' contains an authentication bypass vulnerability. Under the certaEPSS 1.0%CVE-2023-0311MEDIUMImproper Authentication in thorsten/phpmyfaqEPSS 1.0%CVE-2023-1460MEDIUMSourceCodester Online Pizza Ordering System Password Change improper authenticationEPSS 1.0%CVE-2022-36106MEDIUMMissing check for expiration time of password reset token in TYPO3EPSS 1.0%