Weaknesses of type CWE-290

721 results

Autenticação insuficiente contra falsificação de identidade

Ocorre quando o mecanismo de autenticação falha em validar corretamente a identidade do usuário ou cliente, permitindo que um atacante se passe por outra pessoa. A implementação não implementa verificações robustas (como criptografia, assinaturas digitais ou desafios aleatórios), deixando a autenticação vulnerável a spoofing.

Example

Um sistema de API que valida usuários apenas pelo campo 'nome de usuário' em um cabeçalho HTTP sem usar token, sessão ou assinatura criptográfica — um atacante altera o header e acessa dados de outros usuários. Ou um protocolo que aceita certificados autoassinados sem verificar a cadeia de confiança, autenticando servidores falsos.

How to mitigate

Use mecanismos de autenticação estabelecidos e testados: tokens JWT com assinatura, OAuth 2.0, ou mTLS. Sempre valide criptograficamente a identidade do cliente, nunca confie em cabeçalhos ou cookies não assinados. Implemente desafios multi-fator e revogue credenciais comprometidas rapidamente.

CVE-2022-51026CRITICALBytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted LoginEPSS 0.6%CVE-2023-28452HIGHAn issue was discovered in CoreDNS through 1.10.1. There is a vulnerability in DNS resolving software, which triggers a resolver to ignore vEPSS 0.6%CVE-2026-76356HIGHAuthentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAREPSS 0.6%CVE-2025-34063CRITICALOneLogin AD Connector JWT Authentication Bypass via Exposed Signing KeyEPSS 0.6%CVE-2024-46957CRITICALMellium mellium.im/xmpp 0.0.1 through 0.21.4 allows response spoofing if the implementation uses predictable IDs because the stanza type is EPSS 0.6%CVE-2026-54089CRITICALFile Browser: Authentication Bypass via Proxy Auth Header ForgeryEPSS 0.6%CVE-2026-77089CRITICALCommand Center API Authentication BypassEPSS 0.6%CVE-2026-13207HIGHFrangoteam FUXA SCADA/HMI Authentication Bypass by SpoofingEPSS 0.6%CVE-2026-71485CRITICALCentrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backendsEPSS 0.6%CVE-2026-28008CRITICALWordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authentication vulnerabilityEPSS 0.6%CVE-2026-86478CRITICALIn JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeoEPSS 0.6%CVE-2023-3243HIGH ** UNSUPPORTED WHEN ASSIGNED ** [An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a pEPSS 0.6%CVE-2026-62108CRITICALWordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerabilityEPSS 0.6%CVE-2024-22520HIGHAn issue discovered in Dronetag Drone Scanner 1.5.2 allows attackers to impersonate other drones via transmission of crafted data packets.EPSS 0.6%CVE-2026-59157MEDIUMwebhookd: Unrestricted HTTP Header to Shell Variable InjectionEPSS 0.6%CVE-2020-37056MEDIUMCrystal Shard http-protection 0.2.0 - IP Spoofing BypassEPSS 0.6%CVE-2026-46414HIGHMicrosoft UFO WebSocket role spoofing allows authenticated peer task hijackingEPSS 0.6%CVE-2025-30144MEDIUMFast-JWT Improperly Validates iss ClaimsEPSS 0.6%CVE-2022-36331CRITICALImpersonation attack causing an Authentication Bypass on Western Digital devicesEPSS 0.6%CVE-2024-35538MEDIUMTypecho v1.3.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specifyEPSS 0.6%