Weaknesses of type CWE-287

2,850 results

Falha na autenticação ou verificação insuficiente de identidade

Quando um usuário, sistema ou aplicação afirma ser alguém (ou algo), o software não valida adequadamente essa identidade antes de conceder acesso ou executar ações sensíveis. O risco é claro: um atacante se passa por outra pessoa e obtém privilégios ou dados que não deveria ter.

Example

Um app que aceita um token JWT sem verificar a assinatura, confiando apenas no nome de usuário no payload. Um atacante modifica o token para elevar seu nível de acesso e o sistema acredita, pois nunca validou a autenticidade real do token.

How to mitigate

Implemente autenticação robusta: valide credenciais em backend seguro, use protocolos padrão (OAuth 2.0, SAML, Kerberos), verifique integridade de tokens (assinatura criptográfica), implemente MFA para operações críticas e nunca confie em dados do cliente sem validação no servidor.

CVE-2022-39360MEDIUMMetabase SSO users able to circumvent IdP login by doing password resetEPSS 0.6%CVE-2026-55076HIGHCoder's OIDC email_verified type coercion bypass enables account takeover via unverified email linkingEPSS 0.6%CVE-2025-22228HIGHCVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password lengthEPSS 0.6%CVE-2026-51584CRITICALAn issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in serEPSS 0.6%CVE-2026-66908HIGHApache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was acceptedEPSS 0.6%CVE-2022-29237MEDIUMLimited Authentication Bypass for Media Files in OpencastEPSS 0.6%CVE-2023-49791MEDIUMWorkflows do not require password confirmation on API levelEPSS 0.6%CVE-2026-5570MEDIUMTechnostrobe HI-LED-WR120-G2 LoginCB index_config improper authenticationEPSS 0.6%CVE-2023-32202MEDIUMWalchem Intuition Improper AuthenticationEPSS 0.6%CVE-2023-51717CRITICALDataiku DSS before 11.4.5 and 12.4.1 has Incorrect Access Control that could lead to a full authentication bypass.EPSS 0.6%CVE-2025-24895CRITICALSAML Response Signature Verification Bypass in CIE.AspNetCore.AuthenticationEPSS 0.6%CVE-2019-15617—A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login.EPSS 0.6%CVE-2023-22650HIGHRancher does not automatically clean up a user deleted or disabled from the configured Authentication ProviderEPSS 0.6%CVE-2025-24894CRITICALSAML Response Signature Verification Bypass in SPID.AspNetCore.AuthenticationEPSS 0.6%CVE-2026-9695CRITICALImproper Authentication vulnerability affecting DELMIA Apriso from Release 2020 through Release 2026EPSS 0.6%CVE-2026-76673CRITICALAuthentication Bypass Vulnerabilities in API of EdgeConnect SD-WAN OrchestratorEPSS 0.6%CVE-2025-52395CRITICALAn issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the application exposing a password reset API endpoint tEPSS 0.6%CVE-2025-5985MEDIUMcode-projects School Fees Payment System improper authenticationEPSS 0.6%CVE-2026-92792HIGHOpenNHP through 1.0.2 Authentication Bypass via Fallback VerifierEPSS 0.6%CVE-2026-53709CRITICALMCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgeryEPSS 0.6%