Weaknesses of type CWE-290

721 results

Autenticação insuficiente contra falsificação de identidade

Ocorre quando o mecanismo de autenticação falha em validar corretamente a identidade do usuário ou cliente, permitindo que um atacante se passe por outra pessoa. A implementação não implementa verificações robustas (como criptografia, assinaturas digitais ou desafios aleatórios), deixando a autenticação vulnerável a spoofing.

Example

Um sistema de API que valida usuários apenas pelo campo 'nome de usuário' em um cabeçalho HTTP sem usar token, sessão ou assinatura criptográfica — um atacante altera o header e acessa dados de outros usuários. Ou um protocolo que aceita certificados autoassinados sem verificar a cadeia de confiança, autenticando servidores falsos.

How to mitigate

Use mecanismos de autenticação estabelecidos e testados: tokens JWT com assinatura, OAuth 2.0, ou mTLS. Sempre valide criptograficamente a identidade do cliente, nunca confie em cabeçalhos ou cookies não assinados. Implemente desafios multi-fator e revogue credenciais comprometidas rapidamente.

CVE-2024-21494MEDIUMAll versions of the package github.com/greenpau/caddy-security are vulnerable to Authentication Bypass by Spoofing via the X-Forwarded-For hEPSS 0.5%CVE-2022-41798MEDIUMSession information easily guessable vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacenEPSS 0.5%CVE-2023-5801—Vulnerability of identity verification being bypassed in the face unlock module. Successful exploitation of this vulnerability will affect iEPSS 0.5%CVE-2026-36537CRITICALThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The application improperly trusEPSS 0.5%CVE-2020-27276—SOOIL Developments Co Ltd DiabecareRS,AnyDana-i & AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i & AnyDana-A moEPSS 0.5%CVE-2026-55954CRITICALMissing ID token claim validation in ueberauth_apple allows account takeoverEPSS 0.5%CVE-2026-92899MEDIUMApache WSS4J: UsernameToken replay protection bypassed by re-encoding the NonceEPSS 0.5%CVE-2026-33654HIGHZero-Click Indirect Prompt Injection and Authentication Bypass via Email PollingEPSS 0.5%CVE-2026-85432HIGHMOOS core-moos through 10.4.0 MOOSDB Message Source Spoofing via Wire IdentityEPSS 0.5%CVE-2026-16076MEDIUMAstrBotDevs AstrBot API open_api.py OpenApiRoute.chat_send authentication spoofingEPSS 0.5%CVE-2025-22223MEDIUMSpring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authEPSS 0.5%CVE-2026-56675HIGH9router: Reverse proxy locality collapse allows unauthenticated access to 9router /v1 APIsEPSS 0.5%CVE-2026-53791CRITICALrsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol HeaderEPSS 0.5%CVE-2024-50380HIGHAuthentication Bypass by Spoofing in Snap One OVRC cloudEPSS 0.5%CVE-2026-94422HIGHxdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escapeEPSS 0.5%CVE-2026-56020CRITICALWebmin HTTP header authentication bypassEPSS 0.5%CVE-2026-72815MEDIUMgo-chi chi v5.2.1 IP Spoofing via X-Forwarded-For HeaderEPSS 0.5%CVE-2024-30522MEDIUMWordPress Newsletter plugin <= 8.2.0 - IP Blacklist Bypass vulnerabilityEPSS 0.5%CVE-2024-11692MEDIUMAn attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks.EPSS 0.5%CVE-2023-6263HIGHServer Spoofing Vulnerability in NxCloudEPSS 0.5%