Weaknesses of type CWE-287

2,430 results

Falha na autenticação ou verificação insuficiente de identidade

Quando um usuário, sistema ou aplicação afirma ser alguém (ou algo), o software não valida adequadamente essa identidade antes de conceder acesso ou executar ações sensíveis. O risco é claro: um atacante se passa por outra pessoa e obtém privilégios ou dados que não deveria ter.

Example

Um app que aceita um token JWT sem verificar a assinatura, confiando apenas no nome de usuário no payload. Um atacante modifica o token para elevar seu nível de acesso e o sistema acredita, pois nunca validou a autenticidade real do token.

How to mitigate

Implemente autenticação robusta: valide credenciais em backend seguro, use protocolos padrão (OAuth 2.0, SAML, Kerberos), verifique integridade de tokens (assinatura criptográfica), implemente MFA para operações críticas e nunca confie em dados do cliente sem validação no servidor.

CVE-2017-12698—An Improper Authentication issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Specially crafted requests allow a pEPSS 4.8%CVE-2018-14805—ABB eSOMS version 6.0.2 may allow unauthorized access to the system when LDAP is set to allow anonymous authentication, and specific key valEPSS 4.8%CVE-2025-25205HIGHRemote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matchingEPSS 4.8%CVE-2017-14002—GE Infinia/Infinia with Hawkeye 4 medical imaging systems all current versions are affected these devices use default or hard-coded credentiEPSS 4.7%CVE-2019-0543HIGHAn elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of EPSS 4.7%KEVCVE-2017-11427HIGHMultiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversalEPSS 4.7%CVE-2026-24294HIGHWindows SMB Server Elevation of Privilege VulnerabilityEPSS 4.7%CVE-2019-1938CRITICALCisco UCS Director and Cisco UCS Director Express for Big Data API Authentication Bypass VulnerabilityEPSS 4.6%CVE-2019-1974CRITICALCisco IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass VulnerabilityEPSS 4.5%CVE-2024-0799CRITICALAuthentication Bypass via wizardLogin in Arcserve Unified Data ProtectionEPSS 4.3%CVE-2010-4478CRITICALOpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remotEPSS 4.2%CVE-2021-36346MEDIUMDell iDRAC 8 prior to version 2.82.82.82 contain a denial of service vulnerability. An unauthenticated remote attacker could potentially expEPSS 4.2%CVE-2017-6868—An Improper Authentication issue was discovered in Siemens SIMATIC CP 44x-1 RNA, all versions prior to 1.4.1. An unauthenticated remote attaEPSS 4.2%CVE-2023-22893HIGHStrapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for auEPSS 4.1%CVE-2017-3791—A vulnerability in the web-based GUI of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication and executEPSS 4.1%CVE-2018-16886MEDIUMetcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control EPSS 4.0%CVE-2024-47533CRITICALCobbler allows anyone to connect to cobbler XML-RPC server with a known password and make changesEPSS 4.0%CVE-2023-4568MEDIUMPaperCut NG Unauthenticated XMLRPCEPSS 3.9%CVE-2026-48611CRITICALImproper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to uEPSS 3.9%CVE-2017-15135—It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly EPSS 3.8%