Weaknesses of type CWE-290

721 results

Autenticação insuficiente contra falsificação de identidade

Ocorre quando o mecanismo de autenticação falha em validar corretamente a identidade do usuário ou cliente, permitindo que um atacante se passe por outra pessoa. A implementação não implementa verificações robustas (como criptografia, assinaturas digitais ou desafios aleatórios), deixando a autenticação vulnerável a spoofing.

Example

Um sistema de API que valida usuários apenas pelo campo 'nome de usuário' em um cabeçalho HTTP sem usar token, sessão ou assinatura criptográfica — um atacante altera o header e acessa dados de outros usuários. Ou um protocolo que aceita certificados autoassinados sem verificar a cadeia de confiança, autenticando servidores falsos.

How to mitigate

Use mecanismos de autenticação estabelecidos e testados: tokens JWT com assinatura, OAuth 2.0, ou mTLS. Sempre valide criptograficamente a identidade do cliente, nunca confie em cabeçalhos ou cookies não assinados. Implemente desafios multi-fator e revogue credenciais comprometidas rapidamente.

CVE-2025-10530MEDIUMSpoofing issue in the WebAuthn component in Firefox for AndroidEPSS 0.3%CVE-2026-47845MEDIUMReactor Netty HTTP Server may incorrectly evaluate proxy addressesEPSS 0.3%CVE-2022-1745MEDIUM2.2.7 AUTHENTICATION BYPASS BY SPOOFING CWE-290EPSS 0.3%CVE-2024-22457HIGHDell Secure Connect Gateway 5.20 contains an improper authentication vulnerability during the SRS to SCG update path. A remote low privilegeEPSS 0.3%CVE-2026-103302MEDIUMPayment Gateway for Idram < 2.1.6 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant SecretEPSS 0.3%CVE-2026-97274CRITICALWordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerabilityEPSS 0.3%CVE-2023-28803MEDIUMTraffic being bypassed by ZCC by configuring synthetic IP range as local networkEPSS 0.3%CVE-2026-58593HIGHNodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local UserEPSS 0.3%CVE-2026-100390CRITICALZoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6EPSS 0.3%CVE-2026-84849MEDIUMWordPress Pre-Orders for WooCommerce plugin <= 2.3 - Bypass Vulnerability vulnerabilityEPSS 0.3%CVE-2020-7327MEDIUMMcAfee MVEDR - Improperly implemented security checkEPSS 0.3%CVE-2025-29621HIGHFrancois Jacquet RosarioSIS v12.0.0 was discovered to contain a content spoofing vulnerability in the Theme configuration under the My PrefeEPSS 0.3%CVE-2026-123578MEDIUMHickory DNS 0.26.0 before 0.26.2 Response Validation Bypass via QDCOUNT=0EPSS 0.3%CVE-2026-34025MEDIUMIP restriction bypass in Wertheim SafeController Software allows logins from unauthorized network locationsEPSS 0.3%CVE-2026-104891HIGHmppx-condition-gate: Free-access path grants on a self-declared wallet without proving controlEPSS 0.3%CVE-2020-6158MEDIUMOpera Mini for Android before version 52.2 is vulnerable to an address bar spoofing attack. The vulnerability allows a malicious page to triEPSS 0.3%CVE-2025-30142HIGHAn issue was discovered on G-Net Dashcam BB GONX devices. Bypassing of Device Pairing can occur. It uses MAC address verification as the solEPSS 0.3%CVE-2023-29147—In Malwarebytes EDR 1.0.11 for Linux, it is possible to bypass the detection layers that depend on inode identifiers, because an identifier EPSS 0.3%CVE-2026-85511MEDIUMWildfly-elytron-realm-token: parameter injection in eap's elytron oauth2EPSS 0.3%CVE-2024-9391MEDIUMA user who enables full-screen mode on a specially crafted web page could potentially be prevented from exiting full screen mode. This may EPSS 0.3%