Weaknesses of type CWE-287

2,449 results

Falha na autenticação ou verificação insuficiente de identidade

Quando um usuário, sistema ou aplicação afirma ser alguém (ou algo), o software não valida adequadamente essa identidade antes de conceder acesso ou executar ações sensíveis. O risco é claro: um atacante se passa por outra pessoa e obtém privilégios ou dados que não deveria ter.

Example

Um app que aceita um token JWT sem verificar a assinatura, confiando apenas no nome de usuário no payload. Um atacante modifica o token para elevar seu nível de acesso e o sistema acredita, pois nunca validou a autenticidade real do token.

How to mitigate

Implemente autenticação robusta: valide credenciais em backend seguro, use protocolos padrão (OAuth 2.0, SAML, Kerberos), verifique integridade de tokens (assinatura criptográfica), implemente MFA para operações críticas e nunca confie em dados do cliente sem validação no servidor.

CVE-2025-4494MEDIUMJAdmin-JAVA JAdmin Admin Backend NoNeedLoginController.java toLogin improper authenticationEPSS 0.7%CVE-2025-24032CRITICALPAM-PKCS#11 vulnerable to authentication bypass with default value for `cert_policy` (`none`)EPSS 0.7%CVE-2025-54376HIGHHoverfly's WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled.EPSS 0.7%CVE-2026-54635HIGHpytonapi has a Webhook Custom Path Authentication BypassEPSS 0.7%CVE-2026-16209MEDIUMGerapy Project Upload Endpoint views.py missing authenticationEPSS 0.7%CVE-2025-7955CRITICALRingCentral Communications 1.5 - 1.6.8 - Missing Server‑Side Verification to Authentication Bypass via ringcentral_admin_login_2fa_verify FunctionEPSS 0.7%CVE-2024-4303HIGH ArmorX Android APP - MFA BypassEPSS 0.7%CVE-2023-22278MEDIUMm-FILTER prior to Ver.5.70R01 (Ver.5 Series) and m-FILTER prior to Ver.4.87R04 (Ver.4 Series) allows a remote unauthenticated attacker to byEPSS 0.7%CVE-2022-39263MEDIUMNextAuth.js Upstash Adapter missing token verificationEPSS 0.7%CVE-2025-4019MEDIUM20120630 Novel-Plus GeneratorController.java genCode missing authenticationEPSS 0.7%CVE-2024-1610HIGHOPPO Store app include remote account token hijacking and sensitive information leakageEPSS 0.7%CVE-2020-18305HIGHExtreme Networks EXOS before v.22.7 and before v.30.2 was discovered to contain an issue in its Web GUI which fails to restrict URL access, EPSS 0.7%CVE-2025-15455MEDIUMbg5sbk MiniCMS File Recovery Request page.php delete_page improper authenticationEPSS 0.7%CVE-2025-0070CRITICALImproper Authentication in SAP NetWeaver ABAP Server and ABAP PlatformEPSS 0.7%CVE-2023-41956HIGHWordPress Simple Membership plugin <= 4.3.4 - Authenticated Account Takeover vulnerabilityEPSS 0.7%CVE-2025-26685MEDIUMMicrosoft Defender for Identity Spoofing VulnerabilityEPSS 0.7%CVE-2021-32646MEDIUMEscalation of permissions in roomerEPSS 0.7%CVE-2023-0105MEDIUMA flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An EPSS 0.7%CVE-2023-7079MEDIUMArbitrary remote file read in Wrangler dev serverEPSS 0.7%CVE-2024-2112MEDIUMForm Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.22 - Sensitive Information ExposureEPSS 0.7%