Weaknesses of type CWE-290

607 results

Autenticação insuficiente contra falsificação de identidade

Ocorre quando o mecanismo de autenticação falha em validar corretamente a identidade do usuário ou cliente, permitindo que um atacante se passe por outra pessoa. A implementação não implementa verificações robustas (como criptografia, assinaturas digitais ou desafios aleatórios), deixando a autenticação vulnerável a spoofing.

Example

Um sistema de API que valida usuários apenas pelo campo 'nome de usuário' em um cabeçalho HTTP sem usar token, sessão ou assinatura criptográfica — um atacante altera o header e acessa dados de outros usuários. Ou um protocolo que aceita certificados autoassinados sem verificar a cadeia de confiança, autenticando servidores falsos.

How to mitigate

Use mecanismos de autenticação estabelecidos e testados: tokens JWT com assinatura, OAuth 2.0, ou mTLS. Sempre valide criptograficamente a identidade do cliente, nunca confie em cabeçalhos ou cookies não assinados. Implemente desafios multi-fator e revogue credenciais comprometidas rapidamente.

CVE-2026-28812CRITICALApache JSPWiki: UserManager does not sanity-check user database at startupEPSS 0.4%CVE-2023-52176MEDIUMWordPress Malware Scanner plugin <= 4.7.1 - IP Restriction Bypass vulnerabilityEPSS 0.4%CVE-2026-91039CRITICALdynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeoverEPSS 0.4%CVE-2023-40702HIGHPingOne MFA Integration Kit MFA bypassEPSS 0.4%CVE-2023-40356HIGHPingOne MFA Integration Kit MFA bypassEPSS 0.4%CVE-2026-32045HIGHOpenClaw < 2026.2.21 - Authentication Bypass in HTTP Gateway Routes via Tokenless Tailscale AuthEPSS 0.4%CVE-2026-72815MEDIUMgo-chi chi v5.2.1 IP Spoofing via X-Forwarded-For HeaderEPSS 0.4%CVE-2023-41591CRITICALAn issue in Open Network Foundation ONOS v2.7.0 allows attackers to create fake IP/MAC addresses and potentially execute a man-in-the-middleEPSS 0.4%CVE-2024-30058MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.4%CVE-2023-51321MEDIUMA lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Night Club Booking Software v1.0 allows attackers to send an excessivEPSS 0.4%CVE-2023-51323MEDIUMA lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Shared Asset Booking System v1.0 allows attackers to send an excessivEPSS 0.4%CVE-2024-25906MEDIUMWordPress Comments Like Dislike plugin <= 1.2.2 - IP Restriction Bypass Vulnerability vulnerabilityEPSS 0.4%CVE-2025-23168MEDIUMThe Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via emaEPSS 0.4%CVE-2026-42674HIGHWordPress Advanced Access Manager plugin <= 7.1.0 - Bypass Vulnerability vulnerabilityEPSS 0.4%CVE-2024-11701MEDIUMThe incorrect domain may have been displayed in the address bar during an interrupted navigation attempt. This could have led to user confusEPSS 0.4%CVE-2026-59224HIGHOpen WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)EPSS 0.4%CVE-2024-36588MEDIUMAn issue in Annonshop.app DecentralizeJustice/ anonymousLocker commit 2b2b4 allows attackers to send messages erroneously attributed to arbiEPSS 0.4%CVE-2025-43503MEDIUMAn inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOSEPSS 0.4%CVE-2026-77337CRITICALCakePHP: Potential Authentication bypass with CookieAuthenticatorEPSS 0.4%CVE-2021-41130MEDIUMX-Endpoint-API-UserInfo can be spoofed in cloudendpoints Extensible Service ProxyEPSS 0.4%