Weaknesses of type CWE-290

721 results

Autenticação insuficiente contra falsificação de identidade

Ocorre quando o mecanismo de autenticação falha em validar corretamente a identidade do usuário ou cliente, permitindo que um atacante se passe por outra pessoa. A implementação não implementa verificações robustas (como criptografia, assinaturas digitais ou desafios aleatórios), deixando a autenticação vulnerável a spoofing.

Example

Um sistema de API que valida usuários apenas pelo campo 'nome de usuário' em um cabeçalho HTTP sem usar token, sessão ou assinatura criptográfica — um atacante altera o header e acessa dados de outros usuários. Ou um protocolo que aceita certificados autoassinados sem verificar a cadeia de confiança, autenticando servidores falsos.

How to mitigate

Use mecanismos de autenticação estabelecidos e testados: tokens JWT com assinatura, OAuth 2.0, ou mTLS. Sempre valide criptograficamente a identidade do cliente, nunca confie em cabeçalhos ou cookies não assinados. Implemente desafios multi-fator e revogue credenciais comprometidas rapidamente.

CVE-2026-21894MEDIUMn8n's Missing Stripe-Signature Verification Allows Unauthenticated Forged WebhooksEPSS 0.5%CVE-2023-36769MEDIUMMicrosoft OneNote Spoofing VulnerabilityEPSS 0.5%CVE-2023-51327MEDIUMA lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Cleaning Business Software v1.0 allows attackers to send an excessiveEPSS 0.5%CVE-2023-51326MEDIUMA lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Cleaning Business Software v1.0 allows attackers to send an excessiveEPSS 0.5%CVE-2025-1298CRITICALLogic vulnerability in the mobile application (com.transsion.carlcare) may lead to the risk of account takeover.EPSS 0.5%CVE-2026-89022CRITICALBookStack < 26.05.5 Authentication Bypass via Social Login Provider ConfusionEPSS 0.5%CVE-2026-111623MEDIUMXiaozhi-esp32-server-java through 6.1.0 Authentication Bypass via OTA Endpoint Token IssuanceEPSS 0.5%CVE-2026-12382HIGHAap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofingEPSS 0.5%CVE-2026-45045MEDIUMFiber: X-Real-IP Spoofing via Header.Add() in BalancerForwardEPSS 0.5%CVE-2025-66507HIGH1Panel – CAPTCHA Bypass via Client-Controlled FlagEPSS 0.5%CVE-2024-55470HIGHOqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode valiEPSS 0.5%CVE-2026-112241CRITICALWordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerabilityEPSS 0.5%CVE-2024-32786MEDIUMWordPress Royal Elementor Addons and Templates plugin <= 1.3.93 - IP Bypass vulnerabilityEPSS 0.5%CVE-2022-48513—Vulnerability of identity verification being bypassed in the Gallery module. Successful exploitation of this vulnerability may cause out-of-EPSS 0.5%CVE-2024-20384MEDIUMA vulnerability in the Network Service Group (NSG) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DeEPSS 0.5%CVE-2026-76835CRITICALOAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy SetEPSS 0.5%CVE-2026-37604MEDIUMpH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/Ip.class.php from thEPSS 0.5%CVE-2026-25660CRITICALAuthentication bypass for certain API callsEPSS 0.4%CVE-2024-22092HIGHBundlemanager has an authentication bypass vulnerabilityEPSS 0.4%CVE-2026-33175HIGHOAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email ClaimsEPSS 0.4%