Weaknesses of type CWE-290

721 results

Autenticação insuficiente contra falsificação de identidade

Ocorre quando o mecanismo de autenticação falha em validar corretamente a identidade do usuário ou cliente, permitindo que um atacante se passe por outra pessoa. A implementação não implementa verificações robustas (como criptografia, assinaturas digitais ou desafios aleatórios), deixando a autenticação vulnerável a spoofing.

Example

Um sistema de API que valida usuários apenas pelo campo 'nome de usuário' em um cabeçalho HTTP sem usar token, sessão ou assinatura criptográfica — um atacante altera o header e acessa dados de outros usuários. Ou um protocolo que aceita certificados autoassinados sem verificar a cadeia de confiança, autenticando servidores falsos.

How to mitigate

Use mecanismos de autenticação estabelecidos e testados: tokens JWT com assinatura, OAuth 2.0, ou mTLS. Sempre valide criptograficamente a identidade do cliente, nunca confie em cabeçalhos ou cookies não assinados. Implemente desafios multi-fator e revogue credenciais comprometidas rapidamente.

CVE-2023-4566HIGHVulnerability of trust relationships being inaccurate in distributed scenarios. Successful exploitation of this vulnerability may affect serEPSS 0.3%CVE-2026-42662MEDIUMWordPress Event Tickets plugin <= 5.27.5 - Bypass Vulnerability vulnerabilityEPSS 0.3%CVE-2025-27916HIGHAn issue was discovered in AnyDesk for Windows before 9.0.6 and AnyDesk for Android before 8.0.0. When the connection between two clients isEPSS 0.3%CVE-2025-59802HIGHFoxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via OCG. When Optional Content Groups (OCG) are supported, the state prEPSS 0.3%CVE-2026-24853HIGHCaido has an insufficient patch for DNS rebind leading to RCEEPSS 0.3%CVE-2026-105057MEDIUMWordPress Zero Spam plugin <= 5.7.11 - Bypass vulnerability vulnerabilityEPSS 0.3%CVE-2026-15640CRITICALAuthentication Bypass via SAML Response ManipulationEPSS 0.3%CVE-2026-56357MEDIUMn8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook TriggerEPSS 0.3%CVE-2026-56360MEDIUMn8n - Webhook Forgery via Unsigned POST Requests in ZendeskTriggerEPSS 0.3%CVE-2026-119425MEDIUMOPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARPEPSS 0.3%CVE-2024-8273HIGHAuthentication Bypass by Spoofing vulnerability in HYPR Server allows Identity Spoofing.This issue affects Server: before 10.1.EPSS 0.3%CVE-2022-32747HIGHA CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate users to be locked out of devices or facilitatEPSS 0.3%CVE-2026-61428MEDIUMPraisonAI AgentMail before 4.6.78 Message Injection via WebhookEPSS 0.3%CVE-2026-53817HIGHOpenClaw < 2026.5.22 - Control UI Locality Spoofing in Device PairingEPSS 0.3%CVE-2026-53811HIGHOpenClaw < 2026.5.7 - Privilege Escalation via Mutable Display Names in Matrix allowFromEPSS 0.3%CVE-2025-12653MEDIUMAuthentication Bypass by Spoofing in GitLabEPSS 0.3%CVE-2025-61778CRITICALAkka.Remote TLS did not properly implement certificate-based authenticationEPSS 0.3%CVE-2026-45056MEDIUMMatrix Rust SDK: Sender-binding gaps in to-device and room-key attributionEPSS 0.3%CVE-2024-23558MEDIUMHCL DevOps Deploy / HCL Launch does not invalidate all session authentication cookies after logoutEPSS 0.3%CVE-2026-63329MEDIUMWarpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Spoofing to WebSocket Backend TargetsEPSS 0.3%