Weaknesses of type CWE-290

721 results

Autenticação insuficiente contra falsificação de identidade

Ocorre quando o mecanismo de autenticação falha em validar corretamente a identidade do usuário ou cliente, permitindo que um atacante se passe por outra pessoa. A implementação não implementa verificações robustas (como criptografia, assinaturas digitais ou desafios aleatórios), deixando a autenticação vulnerável a spoofing.

Example

Um sistema de API que valida usuários apenas pelo campo 'nome de usuário' em um cabeçalho HTTP sem usar token, sessão ou assinatura criptográfica — um atacante altera o header e acessa dados de outros usuários. Ou um protocolo que aceita certificados autoassinados sem verificar a cadeia de confiança, autenticando servidores falsos.

How to mitigate

Use mecanismos de autenticação estabelecidos e testados: tokens JWT com assinatura, OAuth 2.0, ou mTLS. Sempre valide criptograficamente a identidade do cliente, nunca confie em cabeçalhos ou cookies não assinados. Implemente desafios multi-fator e revogue credenciais comprometidas rapidamente.

CVE-2026-107147MEDIUMAuthentication bypass by spoofing in twofactor_gauthenticatorEPSS 0.4%CVE-2024-36588MEDIUMAn issue in Annonshop.app DecentralizeJustice/ anonymousLocker commit 2b2b4 allows attackers to send messages erroneously attributed to arbiEPSS 0.4%CVE-2026-59224HIGHOpen WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)EPSS 0.4%CVE-2025-43493MEDIUMThe issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, maEPSS 0.4%CVE-2024-8386MEDIUMIf a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform EPSS 0.4%CVE-2021-41130MEDIUMX-Endpoint-API-UserInfo can be spoofed in cloudendpoints Extensible Service ProxyEPSS 0.4%CVE-2026-63683HIGHJoomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions managerEPSS 0.4%CVE-2026-18639HIGHVelociraptor OIDC Authenticator susceptible to email spoofingEPSS 0.4%CVE-2026-28954HIGHA file quarantine bypass was addressed with additional checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, maEPSS 0.4%CVE-2024-4846MEDIUMAuthentication bypass in the 2FA feature in Devolutions Server 2024.1.14.0 and earlier allows an authenticated attacker to authenticate to aEPSS 0.4%CVE-2024-32827MEDIUMWordPress Giveaways and Contests by RafflePress plugin <= 1.12.7 - IP Restriction Bypass vulnerabilityEPSS 0.4%CVE-2025-48937MEDIUMmatrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administratorEPSS 0.4%CVE-2026-61682CRITICALkcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspaceEPSS 0.4%CVE-2025-46345MEDIUMAuth0 Account Link Extension JWT Invalid Signature ValidationEPSS 0.4%CVE-2024-55232MEDIUMAn IDOR vulnerability in the manage-notes.php module in PHPGurukul Online Notes Sharing Management System v1.0 allows unauthorized users to EPSS 0.4%CVE-2026-105640CRITICALPlane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)EPSS 0.4%CVE-2026-62759HIGHWindows Netlogon Spoofing VulnerabilityEPSS 0.4%CVE-2025-69401HIGHWordPress WooODT Lite plugin <= 2.5.2 - Payment Bypass Vulnerability vulnerabilityEPSS 0.4%CVE-2026-45223HIGHCrabbox < 0.9.0 Authentication Bypass via Admin Claim InjectionEPSS 0.4%CVE-2026-24899HIGHFleet Windows MDM Azure AD JWT Authentication BypassEPSS 0.4%