Weaknesses of type CWE-290

721 results

Autenticação insuficiente contra falsificação de identidade

Ocorre quando o mecanismo de autenticação falha em validar corretamente a identidade do usuário ou cliente, permitindo que um atacante se passe por outra pessoa. A implementação não implementa verificações robustas (como criptografia, assinaturas digitais ou desafios aleatórios), deixando a autenticação vulnerável a spoofing.

Example

Um sistema de API que valida usuários apenas pelo campo 'nome de usuário' em um cabeçalho HTTP sem usar token, sessão ou assinatura criptográfica — um atacante altera o header e acessa dados de outros usuários. Ou um protocolo que aceita certificados autoassinados sem verificar a cadeia de confiança, autenticando servidores falsos.

How to mitigate

Use mecanismos de autenticação estabelecidos e testados: tokens JWT com assinatura, OAuth 2.0, ou mTLS. Sempre valide criptograficamente a identidade do cliente, nunca confie em cabeçalhos ou cookies não assinados. Implemente desafios multi-fator e revogue credenciais comprometidas rapidamente.

CVE-2026-87785CRITICALApache Syncope: JWT subject spoofingEPSS 0.5%CVE-2026-84479CRITICALWWBN AVideo Authentication Bypass via User-Agent HeaderEPSS 0.5%CVE-2026-105863CRITICALPayload authentication token field handling issueEPSS 0.5%CVE-2025-59706CRITICALIn N2W before 4.3.2 and 4.4.0 before 4.4.1, improper validation of API request parameters enables remote code execution.EPSS 0.5%CVE-2025-59707CRITICALIn N2W before 4.3.2 and 4.4.x before 4.4.1, there is potential remote code execution and account credentials theft because of a spoofing vulEPSS 0.5%CVE-2023-43304HIGHAn issue in PARK DANDAN mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access EPSS 0.5%CVE-2024-37082CRITICALWhen deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be possible to craft HTTPEPSS 0.5%CVE-2026-94416MEDIUMAap-gateway: aap-gateway: authorization bypass via workload identity token forgeryEPSS 0.5%CVE-2026-121939CRITICALDatabasement before 1.10.9 Account Takeover via OIDC Email Auto-LinkingEPSS 0.5%CVE-2023-4001MEDIUMGrub2: bypass the grub password protection featureEPSS 0.5%CVE-2026-84186MEDIUMIncorrect access control in PrestaShopEPSS 0.5%CVE-2026-64665HIGHStatamic: Account takeover via OAuth email matching without email-verification checkEPSS 0.5%CVE-2024-30479MEDIUMWordPress LionScripts: IP Blocker Lite plugin <= 11.1.1 - Bypass vulnerabilityEPSS 0.5%CVE-2025-48840MEDIUMAn authentication bypass by spoofing vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.8, FortiWeb 7.2 all EPSS 0.5%CVE-2026-58575HIGHDell PowerStore contains an Authentication Bypass by Spoofing vulnerability. An authenticated attacker could potentially exploit this vulnerEPSS 0.5%CVE-2024-6163MEDIUMlocal IP restriction of internal HTTP endpointsEPSS 0.5%CVE-2024-8935HIGHCWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause a denial of service and loss of confidentiality and integriEPSS 0.5%CVE-2026-33661HIGHWeChat Pay callback signature verification bypassed when Host header is localhostEPSS 0.5%CVE-2022-38164MEDIUMA vulnerability affecting F-Secure SAFE browser for Android and iOS was discovered. A maliciously crafted website could make a phishing attaEPSS 0.5%CVE-2024-49214MEDIUMQUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address.EPSS 0.5%