Weaknesses of type CWE-287

2,850 results

Falha na autenticação ou verificação insuficiente de identidade

Quando um usuário, sistema ou aplicação afirma ser alguém (ou algo), o software não valida adequadamente essa identidade antes de conceder acesso ou executar ações sensíveis. O risco é claro: um atacante se passa por outra pessoa e obtém privilégios ou dados que não deveria ter.

Example

Um app que aceita um token JWT sem verificar a assinatura, confiando apenas no nome de usuário no payload. Um atacante modifica o token para elevar seu nível de acesso e o sistema acredita, pois nunca validou a autenticidade real do token.

How to mitigate

Implemente autenticação robusta: valide credenciais em backend seguro, use protocolos padrão (OAuth 2.0, SAML, Kerberos), verifique integridade de tokens (assinatura criptográfica), implemente MFA para operações críticas e nunca confie em dados do cliente sem validação no servidor.

CVE-2025-4019MEDIUM20120630 Novel-Plus GeneratorController.java genCode missing authenticationEPSS 0.7%CVE-2026-89324CRITICALBasel Post Types <= 1.18 - Unauthenticated Authentication Bypass via Forged Opauth Callback Signature with Hardcoded Fallback SaltEPSS 0.7%CVE-2024-1610HIGHOPPO Store app include remote account token hijacking and sensitive information leakageEPSS 0.7%CVE-2020-18305HIGHExtreme Networks EXOS before v.22.7 and before v.30.2 was discovered to contain an issue in its Web GUI which fails to restrict URL access, EPSS 0.7%CVE-2022-36296MEDIUMWordPress ActiveDEMAND plugin <= 0.2.27 - Broken Authentication vulnerabilityEPSS 0.7%CVE-2025-0604MEDIUMKeycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloakEPSS 0.7%CVE-2021-32646MEDIUMEscalation of permissions in roomerEPSS 0.7%CVE-2023-22497MEDIUMNetdata is vulnerable to improper authenticationEPSS 0.7%CVE-2023-7079MEDIUMArbitrary remote file read in Wrangler dev serverEPSS 0.7%CVE-2024-2112MEDIUMForm Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.22 - Sensitive Information ExposureEPSS 0.7%CVE-2024-1148CRITICALWeak Access Control - Arbitrary file uploadEPSS 0.7%CVE-2023-51478CRITICALWordPress Build App Online plugin <= 1.0.19 - Unauthenticated Account Takeover vulnerabilityEPSS 0.7%CVE-2024-1147CRITICALWeak Access Control - Arbitrary file downloadEPSS 0.7%CVE-2023-51477CRITICALWordPress BuddyBoss Theme theme <= 2.4.60 - Unauth. Arbitrary WordPress Settings Change vulnerabilityEPSS 0.7%CVE-2023-51484CRITICALWordPress Login as User or Customer plugin <= 3.8 - Unauthenticated Account Takeover vulnerabilityEPSS 0.7%CVE-2026-19125HIGHEthPress <= 2.3.5 - Unauthenticated Authentication BypassEPSS 0.7%CVE-2022-39009CRITICALThe WLAN module has a vulnerability in permission verification. Successful exploitation of this vulnerability may cause third-party apps to EPSS 0.7%CVE-2026-15542MEDIUMwill-moss Isaiah Websocket Connection Authentication main.go improper authenticationEPSS 0.7%CVE-2025-0070CRITICALImproper Authentication in SAP NetWeaver ABAP Server and ABAP PlatformEPSS 0.7%CVE-2022-47408CRITICALAn issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 tEPSS 0.7%