Weaknesses of type CWE-287

2,850 results

Falha na autenticação ou verificação insuficiente de identidade

Quando um usuário, sistema ou aplicação afirma ser alguém (ou algo), o software não valida adequadamente essa identidade antes de conceder acesso ou executar ações sensíveis. O risco é claro: um atacante se passa por outra pessoa e obtém privilégios ou dados que não deveria ter.

Example

Um app que aceita um token JWT sem verificar a assinatura, confiando apenas no nome de usuário no payload. Um atacante modifica o token para elevar seu nível de acesso e o sistema acredita, pois nunca validou a autenticidade real do token.

How to mitigate

Implemente autenticação robusta: valide credenciais em backend seguro, use protocolos padrão (OAuth 2.0, SAML, Kerberos), verifique integridade de tokens (assinatura criptográfica), implemente MFA para operações críticas e nunca confie em dados do cliente sem validação no servidor.

CVE-2026-90513MEDIUMsimalexan api-lambda-send-email-ses API Gateway Endpoint template.yml SES.sendEmail missing authenticationEPSS 0.8%CVE-2026-87924MEDIUMRizwan17 inventory-management-system Invoice Generation invoice_bill.php missing authenticationEPSS 0.8%CVE-2026-25893CRITICALFUXA Unauthenticated Remote Code Execution via Admin JWT MintingEPSS 0.8%CVE-2026-82547MEDIUMLinux Foundation Magma Registration Complete Message amf_fsm.cpp improper authenticationEPSS 0.8%CVE-2024-12264CRITICALPayU CommercePro Plugin <= 3.8.3 - Unauthenticated Privilege EscalationEPSS 0.8%CVE-2023-21841HIGHVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected areEPSS 0.8%CVE-2020-20402HIGHWestbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation.EPSS 0.8%CVE-2022-38180MEDIUMIn JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some casesEPSS 0.8%CVE-2026-3053MEDIUMDataLinkDC dinky OpenAPI Endpoint AppConfig.java addInterceptors missing authenticationEPSS 0.8%CVE-2022-35726MEDIUMWordPress Video Gallery plugin <= 1.3.4.5 - Broken Authentication vulnerabilityEPSS 0.8%CVE-2022-47508HIGHDisable NTLM: SAM 2022.4 EPSS 0.8%CVE-2026-121615CRITICALLinksys E5600 Login mesh_login.cgi improper authenticationEPSS 0.8%CVE-2024-38139HIGHMicrosoft Dataverse Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2026-40139CRITICALCritical Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote AccessEPSS 0.8%CVE-2023-32682MEDIUMImproper checks for deactivated users during login in synapseEPSS 0.8%CVE-2021-25445—Unprotected component vulnerability in Samsung Internet prior to version 14.2 allows untrusted application to access internal files in SamsuEPSS 0.8%CVE-2023-3622MEDIUMAccess Control Bypass Vulnerability in the SolarWinds Platform EPSS 0.8%CVE-2021-25490MEDIUMA keyblob downgrade attack in keymaster prior to SMR Oct-2021 Release 1 allows attacker to trigger IV reuse vulnerability with privileged prEPSS 0.8%CVE-2026-101956CRITICALJunos OS: Unauthorized root command execution when J-Web is enabledEPSS 0.8%CVE-2026-85636MEDIUMjofpin trape Login Endpoint stats.py missing authenticationEPSS 0.8%