Weaknesses of type CWE-290

721 results

Autenticação insuficiente contra falsificação de identidade

Ocorre quando o mecanismo de autenticação falha em validar corretamente a identidade do usuário ou cliente, permitindo que um atacante se passe por outra pessoa. A implementação não implementa verificações robustas (como criptografia, assinaturas digitais ou desafios aleatórios), deixando a autenticação vulnerável a spoofing.

Example

Um sistema de API que valida usuários apenas pelo campo 'nome de usuário' em um cabeçalho HTTP sem usar token, sessão ou assinatura criptográfica — um atacante altera o header e acessa dados de outros usuários. Ou um protocolo que aceita certificados autoassinados sem verificar a cadeia de confiança, autenticando servidores falsos.

How to mitigate

Use mecanismos de autenticação estabelecidos e testados: tokens JWT com assinatura, OAuth 2.0, ou mTLS. Sempre valide criptograficamente a identidade do cliente, nunca confie em cabeçalhos ou cookies não assinados. Implemente desafios multi-fator e revogue credenciais comprometidas rapidamente.

CVE-2025-24628MEDIUMWordPress reCaptcha by BestWebSoft Plugin <= 1.78 - Captcha Bypass vulnerabilityEPSS 0.4%CVE-2023-34157CRITICALVulnerability of HwWatchHealth being hijacked.Successful exploitation of this vulnerability may cause repeated pop-up windows of the app.EPSS 0.4%CVE-2026-17290HIGHMultiple Vulnerabilities in IBM API ConnectEPSS 0.4%CVE-2026-19291HIGHBluetooth re-pairing can use a lower security level than previousEPSS 0.4%CVE-2026-16101HIGHforced re-pairing with already bonded deviceEPSS 0.4%CVE-2025-54288MEDIUMSource Container Identification Vulnerability via cmdline Spoofing in devLXD ServerEPSS 0.4%CVE-2026-14840MEDIUMYOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header SpoofingEPSS 0.4%CVE-2023-48271MEDIUMWordPress Maspik – Spam Blacklist plugin <= 0.10.3 - IP Filtering Bypass vulnerabilityEPSS 0.4%CVE-2026-18972CRITICALVelociraptor authenticated identity-spoofing vulnerabilityEPSS 0.4%CVE-2023-48753MEDIUMWordPress Restricted Site Access plugin <= 7.4.1 - IP Restriction Bypass vulnerabilityEPSS 0.4%CVE-2026-2800CRITICALSpoofing issue in the WebAuthn component in Firefox for AndroidEPSS 0.3%CVE-2025-66570CRITICALcpp-httplib Untrusted HTTP Header Handling: Internal Header Shadowing (REMOTE*/LOCAL*)EPSS 0.3%CVE-2026-32666HIGHAutomated Logic WebCTRL Premium Server Authentication Bypass by SpoofingEPSS 0.3%CVE-2022-4098HIGHWiesemann & Theis: Multiple products prone to missing authentication through spoofingEPSS 0.3%CVE-2026-73840MEDIUMOpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)EPSS 0.3%CVE-2026-64797HIGHJoomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extensionEPSS 0.3%CVE-2025-46018MEDIUMCSC Pay Mobile App 2.19.4 (fixed in version 2.20.0) contains a vulnerability allowing users to bypass payment authorization by disabling BluEPSS 0.3%CVE-2025-2188HIGHWhitelist bypass Vulnerability in GameCenterEPSS 0.3%CVE-2026-45063CRITICALSymfony: Identity Spoofing via Unanchored DN Regex in X509AuthenticatorEPSS 0.3%CVE-2026-82180CRITICALIn Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFiEPSS 0.3%