Weaknesses of type CWE-287

2,850 results

Falha na autenticação ou verificação insuficiente de identidade

Quando um usuário, sistema ou aplicação afirma ser alguém (ou algo), o software não valida adequadamente essa identidade antes de conceder acesso ou executar ações sensíveis. O risco é claro: um atacante se passa por outra pessoa e obtém privilégios ou dados que não deveria ter.

Example

Um app que aceita um token JWT sem verificar a assinatura, confiando apenas no nome de usuário no payload. Um atacante modifica o token para elevar seu nível de acesso e o sistema acredita, pois nunca validou a autenticidade real do token.

How to mitigate

Implemente autenticação robusta: valide credenciais em backend seguro, use protocolos padrão (OAuth 2.0, SAML, Kerberos), verifique integridade de tokens (assinatura criptográfica), implemente MFA para operações críticas e nunca confie em dados do cliente sem validação no servidor.

CVE-2026-101956CRITICALJunos OS: Unauthorized root command execution when J-Web is enabledEPSS 0.8%CVE-2026-88952CRITICALOAuth2 sign-in attached to an existing account without an email comparison in AshAuthenticationEPSS 0.7%CVE-2025-49812HIGHApache HTTP Server: mod_ssl TLS upgrade attackEPSS 0.7%CVE-2026-76658CRITICALUnauthenticated Remote Code Execution in HPE Networking Fabric Composer SSH DaemonEPSS 0.7%CVE-2026-18961HIGHSocial Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect <= 1.4.3 - Unauthenticated Authentication Bypass via Spotify OAuth CallbackEPSS 0.7%CVE-2026-56169HIGHWindows Admin Center Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2024-22394CRITICALAn improper authentication vulnerability has been identified in SonicWall SonicOS SSL-VPN feature, which in specific conditions could allow EPSS 0.7%CVE-2022-36133CRITICALThe WebConfig functionality of Epson TM-C3500 and TM-C7500 devices with firmware version WAM31500 allows authentication bypass.EPSS 0.7%CVE-2026-76657CRITICALAuthentication Bypass in HPE Networking Fabric Composer API allows Administrative AccessEPSS 0.7%CVE-2023-0105MEDIUMA flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An EPSS 0.7%CVE-2023-6787MEDIUMKeycloak: session hijacking via re-authenticationEPSS 0.7%CVE-2025-7955CRITICALRingCentral Communications 1.5 - 1.6.8 - Missing Server‑Side Verification to Authentication Bypass via ringcentral_admin_login_2fa_verify FunctionEPSS 0.7%CVE-2026-85637MEDIUMjofpin trape Admin Endpoint sockets.py join_room missing authenticationEPSS 0.7%CVE-2021-38679MEDIUMImproper Authentication in Kazoo ServerEPSS 0.7%CVE-2024-28012CRITICALImproper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WEPSS 0.7%CVE-2018-16496—In Versa Director, the un-authentication request found.EPSS 0.7%CVE-2025-7897MEDIUMharry0703 MoneyPrinterTurbo API Endpoint base.py verify_token missing authenticationEPSS 0.7%CVE-2024-33110CRITICALD-Link DIR-845L router v1.01KRb03 and before is vulnerable to Permission Bypass via the getcfg.php component.EPSS 0.7%CVE-2022-31122CRITICALWire-server vulnerable to Token Recipient Confusion resulting in account impersonation, deletion or malicious account creationEPSS 0.7%CVE-2022-0910MEDIUMA downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmwareEPSS 0.7%