Weaknesses of type CWE-287

2,850 results

Falha na autenticação ou verificação insuficiente de identidade

Quando um usuário, sistema ou aplicação afirma ser alguém (ou algo), o software não valida adequadamente essa identidade antes de conceder acesso ou executar ações sensíveis. O risco é claro: um atacante se passa por outra pessoa e obtém privilégios ou dados que não deveria ter.

Example

Um app que aceita um token JWT sem verificar a assinatura, confiando apenas no nome de usuário no payload. Um atacante modifica o token para elevar seu nível de acesso e o sistema acredita, pois nunca validou a autenticidade real do token.

How to mitigate

Implemente autenticação robusta: valide credenciais em backend seguro, use protocolos padrão (OAuth 2.0, SAML, Kerberos), verifique integridade de tokens (assinatura criptográfica), implemente MFA para operações críticas e nunca confie em dados do cliente sem validação no servidor.

CVE-2023-30945CRITICALCVE-2023-30945 EPSS 0.7%CVE-2026-46840CRITICALVulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.0-26.1.0. EasilEPSS 0.7%CVE-2023-22278MEDIUMm-FILTER prior to Ver.5.70R01 (Ver.5 Series) and m-FILTER prior to Ver.4.87R04 (Ver.4 Series) allows a remote unauthenticated attacker to byEPSS 0.7%CVE-2023-44252HIGH** UNSUPPORTED WHEN ASSIGNED **An improper authentication vulnerability [CWE-287] in Fortinet FortiWAN version 5.2.0 through 5.2.1 and versiEPSS 0.7%CVE-2022-39801HIGHSAP GRC Access control Emergency Access Management allows an authenticated attacker to access a Firefighter session even after it is closed EPSS 0.7%CVE-2026-78434MEDIUMFaveo Helpdesk post-ticket-reply Endpoint FormController.php post_ticket_reply missing authenticationEPSS 0.7%CVE-2022-23654HIGHImproper write access check in Requarks/wikiEPSS 0.7%CVE-2026-48929HIGHRocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletionEPSS 0.7%CVE-2026-104014CRITICALNaimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset FinalizationEPSS 0.7%CVE-2026-16656CRITICALVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.7%CVE-2023-45801HIGHImproper Authentication vulnerability in Nadatel DVR allows Information Elicitation.This issue affects DVR: from 3.0.0 before 9.9.0. EPSS 0.7%CVE-2024-53990CRITICALAsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`sEPSS 0.7%CVE-2022-39263MEDIUMNextAuth.js Upstash Adapter missing token verificationEPSS 0.7%CVE-2026-3794MEDIUMdoramart DoraCMS Email API send improper authenticationEPSS 0.7%CVE-2024-28735HIGHUnit4 Financials by Coda versions prior to 2023Q4 suffer from an incorrect access control authorization bypass vulnerability which allows anEPSS 0.7%CVE-2026-16083MEDIUMSipeed PicoClaw LINE Webhook line.go webhook.ParseRequest authentication replayEPSS 0.7%CVE-2023-1617CRITICALImproper Authentication Mechanism in B&R VC4 VisualizationEPSS 0.7%CVE-2023-4373CRITICAL Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager versions 2023.2.19 anEPSS 0.7%CVE-2024-1006HIGHShanxi Diankeyun Technology NODERP Cookie common.php improper authenticationEPSS 0.7%CVE-2025-66022CRITICALFACTION Unauthenticated Custom Extension Upload leads to RCEEPSS 0.7%