Weaknesses of type CWE-287

2,850 results

Falha na autenticação ou verificação insuficiente de identidade

Quando um usuário, sistema ou aplicação afirma ser alguém (ou algo), o software não valida adequadamente essa identidade antes de conceder acesso ou executar ações sensíveis. O risco é claro: um atacante se passa por outra pessoa e obtém privilégios ou dados que não deveria ter.

Example

Um app que aceita um token JWT sem verificar a assinatura, confiando apenas no nome de usuário no payload. Um atacante modifica o token para elevar seu nível de acesso e o sistema acredita, pois nunca validou a autenticidade real do token.

How to mitigate

Implemente autenticação robusta: valide credenciais em backend seguro, use protocolos padrão (OAuth 2.0, SAML, Kerberos), verifique integridade de tokens (assinatura criptográfica), implemente MFA para operações críticas e nunca confie em dados do cliente sem validação no servidor.

CVE-2026-86306MEDIUMlight0011 cms Cookie Helper UserModel.class.php improper authenticationEPSS 0.7%CVE-2026-47156CRITICALMantisBT: SOAP API Authentication Bypass with Privilege Escalation to AdministratorEPSS 0.7%CVE-2026-92401MEDIUMChangeWeDer crm improper authenticationEPSS 0.7%CVE-2026-16210MEDIUMnewpanjing simpleui AjaxAdmin AJAX Endpoint admin.py self.get_action missing authenticationEPSS 0.7%CVE-2025-3621CRITICALRemote Code Execution in ProTNS ActADUREPSS 0.7%CVE-2026-82758MEDIUMash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpointEPSS 0.7%CVE-2026-90840MEDIUMPHPGurukul Blood Donor Management System Admin Controllers Dashboard.php __construct improper authenticationEPSS 0.7%CVE-2026-121530MEDIUMA improper authentication vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6 may allow a remote authenticated attacker to gain improper aEPSS 0.7%CVE-2026-86292MEDIUMSourceCodester Simple Traffic Offense System User Creation saveuser.php missing authenticationEPSS 0.7%CVE-2026-19607MEDIUMKeycloak-services: keycloak-services: broker-originated username collision causes account lockoutEPSS 0.7%CVE-2024-41196CRITICALAn issue in Ocuco Innovation - REPORTSERVER.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to AdministratEPSS 0.7%CVE-2026-69854CRITICALSpring Cloud Azure Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2026-18990MEDIUMletta-ai LettaBot API Status Route server.ts missing authenticationEPSS 0.7%CVE-2026-87922MEDIUMRizwan17 inventory-management-system AJAX Backend process.php DBOperation.addCategory missing authenticationEPSS 0.7%CVE-2022-48364MEDIUMThe undo_mark_statuses_as_sensitive method in app/services/approve_appeal_service.rb in Mastodon 3.5.x before 3.5.3 does not use the server'EPSS 0.7%CVE-2022-24901HIGHAuthentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter EPSS 0.7%CVE-2026-4664MEDIUMCustomer Reviews for WooCommerce <= 5.103.0 - Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' ParameterEPSS 0.7%CVE-2024-27767CRITICALUnitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-287: Improper AuthenticationEPSS 0.7%CVE-2023-44752CRITICALAn issue in Student Study Center Desk Management System v1.0 allows attackers to bypass authentication via a crafted GET request to /php-sscEPSS 0.7%CVE-2026-50561CRITICALYuxi has a JWT Authentication Bypass Leading to Cross-Instance Administrator Token ReuseEPSS 0.7%