Weaknesses of type CWE-290

607 results

Autenticação insuficiente contra falsificação de identidade

Ocorre quando o mecanismo de autenticação falha em validar corretamente a identidade do usuário ou cliente, permitindo que um atacante se passe por outra pessoa. A implementação não implementa verificações robustas (como criptografia, assinaturas digitais ou desafios aleatórios), deixando a autenticação vulnerável a spoofing.

Example

Um sistema de API que valida usuários apenas pelo campo 'nome de usuário' em um cabeçalho HTTP sem usar token, sessão ou assinatura criptográfica — um atacante altera o header e acessa dados de outros usuários. Ou um protocolo que aceita certificados autoassinados sem verificar a cadeia de confiança, autenticando servidores falsos.

How to mitigate

Use mecanismos de autenticação estabelecidos e testados: tokens JWT com assinatura, OAuth 2.0, ou mTLS. Sempre valide criptograficamente a identidade do cliente, nunca confie em cabeçalhos ou cookies não assinados. Implemente desafios multi-fator e revogue credenciais comprometidas rapidamente.

CVE-2026-28465HIGHOpenClaw voice-call < 2026.2.3 - Webhook Verification Bypass via Forwarded HeadersEPSS 0.4%CVE-2026-40460MEDIUMNGINX ngx_quic_module vulnerabilityEPSS 0.4%CVE-2026-61428MEDIUMPraisonAI AgentMail before 4.6.78 Message Injection via WebhookEPSS 0.4%CVE-2024-32708LOWWordPress Maintenance Mode plugin <= 3.0.1 - IP Bypass vulnerabilityEPSS 0.4%CVE-2023-41134MEDIUMWordPress Antispam Bee plugin <= 2.11.3 - Country IP Restriction Bypass vulnerabilityEPSS 0.4%CVE-2020-7326MEDIUMMcAfee MAR - Improperly implemented security checkEPSS 0.4%CVE-2023-51542MEDIUMWordPress Branda plugin <= 3.4.14 - IP Restriction Bypass vulnerabilityEPSS 0.4%CVE-2024-8908MEDIUMInappropriate implementation in Autofill in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafEPSS 0.4%CVE-2025-48937MEDIUMmatrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administratorEPSS 0.4%CVE-2024-55232MEDIUMAn IDOR vulnerability in the manage-notes.php module in PHPGurukul Online Notes Sharing Management System v1.0 allows unauthorized users to EPSS 0.4%CVE-2026-45063CRITICALSymfony: Identity Spoofing via Unanchored DN Regex in X509AuthenticatorEPSS 0.4%CVE-2024-20363MEDIUMMultiple Cisco products are affected by a vulnerability in the Snort Intrusion Prevention System (IPS) rule engine that could allow an unautEPSS 0.4%CVE-2026-8651LOWIPv6 Loopback Spoof via Trusted Host Header Bypasses Origin Check in MOVEit TransferEPSS 0.4%CVE-2024-7745MEDIUMMulti-Factor Authentication Bypass in Progress WS_FTP ServerEPSS 0.4%CVE-2026-22734HIGHCloud Foundry UAA SAML 2.0 Signature BypassEPSS 0.4%CVE-2024-55925HIGHAPI Security bypass through header manipulationEPSS 0.4%CVE-2025-43493MEDIUMThe issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, maEPSS 0.4%CVE-2026-76356HIGHAuthentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAREPSS 0.4%CVE-2025-46345MEDIUMAuth0 Account Link Extension JWT Invalid Signature ValidationEPSS 0.4%CVE-2025-25055MEDIUMAuthentication bypass by spoofing issue exists in FileMegane versions above 1.0.0.0 prior to 3.4.0.0, which may lead to user impersonation. EPSS 0.4%