Weaknesses of type CWE-290

721 results

Autenticação insuficiente contra falsificação de identidade

Ocorre quando o mecanismo de autenticação falha em validar corretamente a identidade do usuário ou cliente, permitindo que um atacante se passe por outra pessoa. A implementação não implementa verificações robustas (como criptografia, assinaturas digitais ou desafios aleatórios), deixando a autenticação vulnerável a spoofing.

Example

Um sistema de API que valida usuários apenas pelo campo 'nome de usuário' em um cabeçalho HTTP sem usar token, sessão ou assinatura criptográfica — um atacante altera o header e acessa dados de outros usuários. Ou um protocolo que aceita certificados autoassinados sem verificar a cadeia de confiança, autenticando servidores falsos.

How to mitigate

Use mecanismos de autenticação estabelecidos e testados: tokens JWT com assinatura, OAuth 2.0, ou mTLS. Sempre valide criptograficamente a identidade do cliente, nunca confie em cabeçalhos ou cookies não assinados. Implemente desafios multi-fator e revogue credenciais comprometidas rapidamente.

CVE-2026-52845HIGHCaddy: FastCGI header normalization bypass in `forward_auth copy_headers`EPSS 0.4%CVE-2026-3902HIGHASGI header spoofing via underscore/hyphen conflationEPSS 0.4%CVE-2026-82530MEDIUMIP2Location Country Blocker < 2.45.0 Access Control Bypass via X-Real-IP HeaderEPSS 0.4%CVE-2026-123033HIGHAuthentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release trains before their reEPSS 0.4%CVE-2026-19538HIGHBypass of BLOCKED ACL items on proxy protocol port over TCP or TLSEPSS 0.4%CVE-2026-119744HIGHCendio ThinLinc Improper Authentication via Web AccessEPSS 0.4%CVE-2026-86196HIGHGrav API Plugin before 1.0.20 Authentication Bypass via Host HeaderEPSS 0.4%CVE-2023-51667MEDIUMWordPress Rate my Post – WP Rating System plugin <= 3.4.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-28465HIGHOpenClaw voice-call < 2026.2.3 - Webhook Verification Bypass via Forwarded HeadersEPSS 0.4%CVE-2026-84476HIGHWWBN AVideo Authentication Bypass via X-Real-IP HeaderEPSS 0.4%CVE-2024-22139LOWWordPress WordPress Manutenção plugin <= 1.0.6 - Bypass vulnerabilityEPSS 0.4%CVE-2026-47381MEDIUMNocoDB: Cross-Workspace Integration Use in Connection TestEPSS 0.4%CVE-2026-24000MEDIUMFleet has a rate limiting bypass via untrusted client IP headersEPSS 0.4%CVE-2025-28128HIGHAn issue in Mytel Telecom Online Account System v1.0 allows attackers to bypass the OTP verification process via a crafted request.EPSS 0.4%CVE-2026-0834HIGHLogic Vulnerability on TP-Link Archer C20, Archer AX53 and TL-WR841N v13EPSS 0.4%CVE-2026-18065MEDIUMIBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.EPSS 0.4%CVE-2026-50141HIGHWoodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonationEPSS 0.4%CVE-2025-31511HIGHAn issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. One can bypass manager approval by changing the user ID in a Request%20BuiEPSS 0.4%CVE-2025-22271MEDIUMIP Spoofing in CyberArk Endpoint Privilege ManagerEPSS 0.4%CVE-2026-52690MEDIUMSpoofed answers can mark an authoritative non-EDNS capableEPSS 0.4%