Weaknesses of type CWE-287

2,850 results

Falha na autenticação ou verificação insuficiente de identidade

Quando um usuário, sistema ou aplicação afirma ser alguém (ou algo), o software não valida adequadamente essa identidade antes de conceder acesso ou executar ações sensíveis. O risco é claro: um atacante se passa por outra pessoa e obtém privilégios ou dados que não deveria ter.

Example

Um app que aceita um token JWT sem verificar a assinatura, confiando apenas no nome de usuário no payload. Um atacante modifica o token para elevar seu nível de acesso e o sistema acredita, pois nunca validou a autenticidade real do token.

How to mitigate

Implemente autenticação robusta: valide credenciais em backend seguro, use protocolos padrão (OAuth 2.0, SAML, Kerberos), verifique integridade de tokens (assinatura criptográfica), implemente MFA para operações críticas e nunca confie em dados do cliente sem validação no servidor.

CVE-2024-50640CRITICALjeewx-boot 1.3 has an authentication bypass vulnerability in the preHandle functionEPSS 0.6%CVE-2021-25368LOWHijacking vulnerability in Samsung Cloud prior to version 4.7.0.3 allows attackers to intercept when the provider is executed.EPSS 0.6%CVE-2026-16015MEDIUMpoco-ai poco-claw executor_manager API tasks.py create_task missing authenticationEPSS 0.6%CVE-2026-68300CRITICALsctp: auth: verify auth requirement when auth_chunk is NULLEPSS 0.6%CVE-2024-12287CRITICALBiagiotti Membership <= 1.0.2 - Authentication Bypass via biagiotti_membership_check_facebook_userEPSS 0.6%CVE-2026-75774MEDIUMkarakeep-app karakeep OAuth Sign-In auth.ts improper authenticationEPSS 0.6%CVE-2023-37226CRITICALLoftware Spectrum before 4.6 HF14 has Missing Authentication for a Critical Function.EPSS 0.6%CVE-2024-56329HIGHAccount Takeover Vulnerability in Social Account Linking in joelbutcher/socialstreamEPSS 0.6%CVE-2026-17326HIGHMultiple Vulnerabilities in IBM API ConnectEPSS 0.6%CVE-2026-93960MEDIUMPixelfed OAuth Scope ApiV1Controller.php instancePeers missing authenticationEPSS 0.6%CVE-2024-45106HIGHApache Ozone: Improper authentication when generating S3 secretsEPSS 0.6%CVE-2026-101521CRITICALVulnerability in Oracle APEX (component: General). Supported versions that are affected are 24.1.0-24.1.21, 24.2.0-24.2.20 and 26.1.0-26.1EPSS 0.6%CVE-2026-52827HIGHKimai: Two-factor authentication bypass on the Kimai APIEPSS 0.6%CVE-2026-75957CRITICALUltimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' ParameterEPSS 0.6%CVE-2026-109516CRITICALBot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login TokenEPSS 0.6%CVE-2024-12919CRITICALPaid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.7 - Authentication Bypass via pms_payment_idEPSS 0.6%CVE-2026-19660CRITICALDivi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' ParameterEPSS 0.6%CVE-2022-37774MEDIUMThere is a broken access control vulnerability in the Maarch RM 2.8.3 solution. When accessing some specific document (pdf, email) from an aEPSS 0.6%CVE-2025-15457MEDIUMbg5sbk MiniCMS Trash File Restore post.php improper authenticationEPSS 0.6%CVE-2026-82906MEDIUMsdcb chats Signed File Download Endpoint FileController.cs DownloadPublic missing authenticationEPSS 0.6%