Weaknesses of type CWE-287

2,850 results

Falha na autenticação ou verificação insuficiente de identidade

Quando um usuário, sistema ou aplicação afirma ser alguém (ou algo), o software não valida adequadamente essa identidade antes de conceder acesso ou executar ações sensíveis. O risco é claro: um atacante se passa por outra pessoa e obtém privilégios ou dados que não deveria ter.

Example

Um app que aceita um token JWT sem verificar a assinatura, confiando apenas no nome de usuário no payload. Um atacante modifica o token para elevar seu nível de acesso e o sistema acredita, pois nunca validou a autenticidade real do token.

How to mitigate

Implemente autenticação robusta: valide credenciais em backend seguro, use protocolos padrão (OAuth 2.0, SAML, Kerberos), verifique integridade de tokens (assinatura criptográfica), implemente MFA para operações críticas e nunca confie em dados do cliente sem validação no servidor.

CVE-2025-26685MEDIUMMicrosoft Defender for Identity Spoofing VulnerabilityEPSS 0.7%CVE-2025-63224CRITICALThe Itel DAB Encoder (IDEnc build 25aec8d) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers cEPSS 0.7%CVE-2023-30967CRITICALGotham Orbital Simulator path traversalEPSS 0.7%CVE-2017-20133HIGHItech Job Portal Script admin improper authenticationEPSS 0.7%CVE-2022-44569HIGHA locally authenticated attacker with low privileges can bypass authentication due to insecure inter-process communication.EPSS 0.7%CVE-2023-44397HIGHCloudExplorer Lite permission bypass vulnerabilityEPSS 0.7%CVE-2026-19806HIGHSupport Genix <= 1.4.52 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest TokenEPSS 0.7%CVE-2023-3638CRITICALGeoVision GV-ADR2701 Improper AuthenticationEPSS 0.7%CVE-2023-46942HIGHLack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive informatioEPSS 0.7%CVE-2026-40920CRITICALApache Ranger: Privilege Escalation via URL ParameterEPSS 0.7%CVE-2023-51982CRITICALCrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component. After configuring password authentication and_ LEPSS 0.7%CVE-2024-45148HIGHAdobe Commerce | Improper Authentication (CWE-287)EPSS 0.7%CVE-2026-5229CRITICALReceive Notifications After Form Submitting – Form Notify for Any Forms <= 1.1.10 - Unauthenticated Authentication Bypass via LINE OAuth CallbackEPSS 0.7%CVE-2026-94493CRITICALGigatech PDV5701 WebSocket Service index.html missing authenticationEPSS 0.7%CVE-2026-17182CRITICALIBM Db2 Mirror for i is affected by multiple vulnerabilitiesEPSS 0.7%CVE-2021-40506CRITICALAn issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. The overflow flag is not EPSS 0.7%CVE-2021-40507CRITICALAn issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. The overflow flag is not EPSS 0.7%CVE-2026-29145CRITICALApache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabledEPSS 0.7%CVE-2026-109467CRITICALAzure DevOps Server Remote Code Execution VulnerabilityEPSS 0.7%CVE-2020-5425HIGHUser Impersonation possible in Tanzu SSOEPSS 0.7%