Weaknesses of type CWE-290

607 results

Autenticação insuficiente contra falsificação de identidade

Ocorre quando o mecanismo de autenticação falha em validar corretamente a identidade do usuário ou cliente, permitindo que um atacante se passe por outra pessoa. A implementação não implementa verificações robustas (como criptografia, assinaturas digitais ou desafios aleatórios), deixando a autenticação vulnerável a spoofing.

Example

Um sistema de API que valida usuários apenas pelo campo 'nome de usuário' em um cabeçalho HTTP sem usar token, sessão ou assinatura criptográfica — um atacante altera o header e acessa dados de outros usuários. Ou um protocolo que aceita certificados autoassinados sem verificar a cadeia de confiança, autenticando servidores falsos.

How to mitigate

Use mecanismos de autenticação estabelecidos e testados: tokens JWT com assinatura, OAuth 2.0, ou mTLS. Sempre valide criptograficamente a identidade do cliente, nunca confie em cabeçalhos ou cookies não assinados. Implemente desafios multi-fator e revogue credenciais comprometidas rapidamente.

CVE-2025-36753HIGHSWD Interface Open on Growatt ShineLan-XEPSS 0.3%CVE-2023-4566HIGHVulnerability of trust relationships being inaccurate in distributed scenarios. Successful exploitation of this vulnerability may affect serEPSS 0.3%CVE-2025-32275MEDIUMWordPress Survey Maker plugin <= 5.1.6.3 - Bypass vulnerabilityEPSS 0.3%CVE-2026-84479CRITICALWWBN AVideo Authentication Bypass via User-Agent HeaderEPSS 0.3%CVE-2025-59802HIGHFoxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via OCG. When Optional Content Groups (OCG) are supported, the state prEPSS 0.3%CVE-2026-42662MEDIUMWordPress Event Tickets plugin <= 5.27.5 - Bypass Vulnerability vulnerabilityEPSS 0.3%CVE-2025-56608MEDIUMThe SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in `OkHttpClientWrapper.java`EPSS 0.3%CVE-2022-32747HIGHA CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate users to be locked out of devices or facilitatEPSS 0.3%CVE-2026-56357MEDIUMn8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook TriggerEPSS 0.3%CVE-2026-56360MEDIUMn8n - Webhook Forgery via Unsigned POST Requests in ZendeskTriggerEPSS 0.3%CVE-2026-35656MEDIUMOpenClaw < 2026.3.22 - XFF Loopback Spoofing Bypass in Canvas Authentication and Rate LimiterEPSS 0.3%CVE-2026-18677MEDIUMKong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identityEPSS 0.3%CVE-2026-14199HIGHSession takeover via Auth Proxy cache key collisionEPSS 0.3%CVE-2026-2800CRITICALSpoofing issue in the WebAuthn component in Firefox for AndroidEPSS 0.3%CVE-2026-18065MEDIUMIBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.EPSS 0.3%CVE-2026-64665HIGHStatamic: Account takeover via OAuth email matching without email-verification checkEPSS 0.3%CVE-2024-8273HIGHAuthentication Bypass by Spoofing vulnerability in HYPR Server allows Identity Spoofing.This issue affects Server: before 10.1.EPSS 0.3%CVE-2025-11843HIGHTherefore™ Online and Therefore™ On-Premises contains an account impersonation issue, which could potentially allow the attacker to access all the stored dataEPSS 0.3%CVE-2025-32227MEDIUMWordPress Asgaros Forum plugin <= 3.0.0 - File Upload Numbers Bypass vulnerabilityEPSS 0.3%CVE-2025-12430HIGHObject lifecycle issue in Media in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML EPSS 0.3%