Weaknesses of type CWE-287

2,850 results

Falha na autenticação ou verificação insuficiente de identidade

Quando um usuário, sistema ou aplicação afirma ser alguém (ou algo), o software não valida adequadamente essa identidade antes de conceder acesso ou executar ações sensíveis. O risco é claro: um atacante se passa por outra pessoa e obtém privilégios ou dados que não deveria ter.

Example

Um app que aceita um token JWT sem verificar a assinatura, confiando apenas no nome de usuário no payload. Um atacante modifica o token para elevar seu nível de acesso e o sistema acredita, pois nunca validou a autenticidade real do token.

How to mitigate

Implemente autenticação robusta: valide credenciais em backend seguro, use protocolos padrão (OAuth 2.0, SAML, Kerberos), verifique integridade de tokens (assinatura criptográfica), implemente MFA para operações críticas e nunca confie em dados do cliente sem validação no servidor.

CVE-2025-52572CRITICALHikka vulnerable to RCE through dangling web interfaceEPSS 0.7%CVE-2024-24830CRITICALOpenObserve Privilege Escalation Vulnerability in Users APIEPSS 0.7%CVE-2022-23554MEDIUMAuthentication bypass in AlpineEPSS 0.7%CVE-2023-34246MEDIUMDoorkeeper Improper Authentication vulnerabilityEPSS 0.7%CVE-2017-12281—A vulnerability in the implementation of Protected Extensible Authentication Protocol (PEAP) functionality for standalone configurations of EPSS 0.7%CVE-2025-60424HIGHA lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication vEPSS 0.7%CVE-2022-2757CRITICAL Due to the lack of adequately implemented access-control rules, all versions Kingspan TMS300 CS are vulnerable to an attacker viewing andEPSS 0.7%CVE-2025-32877CRITICALAn issue was discovered on COROS PACE 3 devices through 3.0808.0. It identifies itself as a device without input or output capabilities, whiEPSS 0.7%CVE-2017-7937—An Improper Authentication issue was discovered in Phoenix Contact GmbH mGuard firmware versions 8.3.0 to 8.4.2. An attacker may be able to EPSS 0.7%CVE-2024-10173MEDIUMdidi DDMQ Console Module improper authenticationEPSS 0.7%CVE-2023-33190CRITICALImproperly configured permissions in SealosEPSS 0.7%CVE-2025-24032CRITICALPAM-PKCS#11 vulnerable to authentication bypass with default value for `cert_policy` (`none`)EPSS 0.7%CVE-2026-101077CRITICALNetcore NR289-GE boa_temp process_request missing authenticationEPSS 0.7%CVE-2025-54376HIGHHoverfly's WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled.EPSS 0.7%CVE-2026-16209MEDIUMGerapy Project Upload Endpoint views.py missing authenticationEPSS 0.7%CVE-2026-110799CRITICALVvveb: Authentication Bypass via PHP Array Injection leading to full Account TakeoverEPSS 0.7%CVE-2026-0953CRITICALTutor LMS Pro <= 3.9.5 - Authentication Bypass via Social LoginEPSS 0.7%CVE-2024-4303HIGH ArmorX Android APP - MFA BypassEPSS 0.7%CVE-2015-5298—The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jenkins instances that EPSS 0.7%CVE-2022-2664HIGHPrivate Cloud Management Platform POST Request global_config_query improper authenticationEPSS 0.7%