Weaknesses of type CWE-290

721 results

Autenticação insuficiente contra falsificação de identidade

Ocorre quando o mecanismo de autenticação falha em validar corretamente a identidade do usuário ou cliente, permitindo que um atacante se passe por outra pessoa. A implementação não implementa verificações robustas (como criptografia, assinaturas digitais ou desafios aleatórios), deixando a autenticação vulnerável a spoofing.

Example

Um sistema de API que valida usuários apenas pelo campo 'nome de usuário' em um cabeçalho HTTP sem usar token, sessão ou assinatura criptográfica — um atacante altera o header e acessa dados de outros usuários. Ou um protocolo que aceita certificados autoassinados sem verificar a cadeia de confiança, autenticando servidores falsos.

How to mitigate

Use mecanismos de autenticação estabelecidos e testados: tokens JWT com assinatura, OAuth 2.0, ou mTLS. Sempre valide criptograficamente a identidade do cliente, nunca confie em cabeçalhos ou cookies não assinados. Implemente desafios multi-fator e revogue credenciais comprometidas rapidamente.

CVE-2026-67558HIGHMira Hormone Monitor, Mira Android App Authentication bypass by spoofingEPSS 0.3%CVE-2024-5812LOWSmart Rule Overwrite Bypass in BeyondInsight PasswordSafeEPSS 0.3%CVE-2026-96336HIGHWordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerabilityEPSS 0.3%CVE-2025-27616HIGHVela Server has Insufficient Webhook Payload Data VerificationEPSS 0.3%CVE-2026-107447MEDIUMContest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP and Forgeable Voter IdentityEPSS 0.3%CVE-2023-54411HIGHFrappe before 13.32.0 Weak Authentication via Print View KeyEPSS 0.3%CVE-2024-31784MEDIUMAn issue in Typora v.1.8.10 and before, allows a local attacker to obtain sensitive information and execute arbitrary code via a crafted payEPSS 0.3%CVE-2026-11019MEDIUMInappropriate implementation in Payments in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised thEPSS 0.3%CVE-2026-90711CRITICALproxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnetEPSS 0.3%CVE-2026-62224LOWOpenClaw MS Teams < 2026.5.12 Authorization BypassEPSS 0.3%CVE-2026-62644MEDIUMIn Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing viaEPSS 0.3%CVE-2026-115962MEDIUMWordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerabilityEPSS 0.3%CVE-2026-41558HIGHWordPress WP Migration Plugin DB & Files – WP Synchro plugin <= 1.16.1 - 2FA Bypass vulnerabilityEPSS 0.3%CVE-2026-123017MEDIUMGodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A grant_gold(1000000) call can be forged.EPSS 0.3%CVE-2025-11209HIGHInappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker to spoof the contents oEPSS 0.3%CVE-2026-11870MEDIUMHide My WP Ghost < 7.0.05 - IP Address Spoofing via Trusted Proxy Headers Leading to Protection Mechanism BypassEPSS 0.3%CVE-2026-70381MEDIUMUnauthorized Access to Internal Web ResourcesEPSS 0.3%CVE-2026-15812MEDIUMKronosnet: kronosnet: access control list bypass via link id spoofing on unencrypted dynamic linksEPSS 0.3%CVE-2026-96615HIGHNGINX Gateway Fabric vulnerabilityEPSS 0.3%CVE-2026-89327LOWFluentBoards < 2.0.15 - Board Member+ Comment Author Spoofing via 'comment_by' ParameterEPSS 0.3%