Weaknesses of type CWE-290

721 results

Autenticação insuficiente contra falsificação de identidade

Ocorre quando o mecanismo de autenticação falha em validar corretamente a identidade do usuário ou cliente, permitindo que um atacante se passe por outra pessoa. A implementação não implementa verificações robustas (como criptografia, assinaturas digitais ou desafios aleatórios), deixando a autenticação vulnerável a spoofing.

Example

Um sistema de API que valida usuários apenas pelo campo 'nome de usuário' em um cabeçalho HTTP sem usar token, sessão ou assinatura criptográfica — um atacante altera o header e acessa dados de outros usuários. Ou um protocolo que aceita certificados autoassinados sem verificar a cadeia de confiança, autenticando servidores falsos.

How to mitigate

Use mecanismos de autenticação estabelecidos e testados: tokens JWT com assinatura, OAuth 2.0, ou mTLS. Sempre valide criptograficamente a identidade do cliente, nunca confie em cabeçalhos ou cookies não assinados. Implemente desafios multi-fator e revogue credenciais comprometidas rapidamente.

CVE-2023-34160MEDIUMVulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app EPSS 0.3%CVE-2023-34158MEDIUMVulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app EPSS 0.3%CVE-2025-30110MEDIUMOn IROAD X5 devices, a Bypass of Device Pairing can occur via MAC Address Spoofing. The dashcam's pairing mechanism relies solely on MAC addEPSS 0.3%CVE-2023-34167MEDIUMVulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app EPSS 0.3%CVE-2025-65046LOWMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.3%CVE-2025-24091MEDIUMAn app could impersonate system notifications. Sensitive notifications now require restricted entitlements. This issue is fixed in iOS 18.3 EPSS 0.3%CVE-2026-46356MEDIUMFleet: IP spoofing allows bypassing API rate limitingEPSS 0.3%CVE-2026-16404HIGHSpoofing issue in Firefox for AndroidEPSS 0.3%CVE-2026-104623MEDIUMAuthorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management clusterEPSS 0.3%CVE-2024-8399MEDIUMWebsites could utilize Javascript links to spoof URL addresses in the Focus navigation bar This vulnerability affects Focus for iOS < 130.EPSS 0.3%CVE-2026-0385MEDIUMMicrosoft Edge (Chromium-based) for Android Spoofing VulnerabilityEPSS 0.3%CVE-2026-86039HIGHlibp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addressesEPSS 0.3%CVE-2026-118513HIGHSymfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063)EPSS 0.3%CVE-2026-27700HIGHHono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfoEPSS 0.3%CVE-2026-93628MEDIUMZimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee ResponseEPSS 0.3%CVE-2026-93629MEDIUMZimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer IdentityEPSS 0.3%CVE-2026-93627MEDIUMZimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST OrganizerEPSS 0.3%CVE-2026-96333HIGHWordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerabilityEPSS 0.3%CVE-2026-67558HIGHMira Hormone Monitor, Mira Android App Authentication bypass by spoofingEPSS 0.3%CVE-2026-27089HIGHWordPress WpTravelly plugin <= 2.1.7 - Bypass Vulnerability vulnerabilityEPSS 0.3%