Weaknesses of type CWE-290

606 results

Autenticação insuficiente contra falsificação de identidade

Ocorre quando o mecanismo de autenticação falha em validar corretamente a identidade do usuário ou cliente, permitindo que um atacante se passe por outra pessoa. A implementação não implementa verificações robustas (como criptografia, assinaturas digitais ou desafios aleatórios), deixando a autenticação vulnerável a spoofing.

Example

Um sistema de API que valida usuários apenas pelo campo 'nome de usuário' em um cabeçalho HTTP sem usar token, sessão ou assinatura criptográfica — um atacante altera o header e acessa dados de outros usuários. Ou um protocolo que aceita certificados autoassinados sem verificar a cadeia de confiança, autenticando servidores falsos.

How to mitigate

Use mecanismos de autenticação estabelecidos e testados: tokens JWT com assinatura, OAuth 2.0, ou mTLS. Sempre valide criptograficamente a identidade do cliente, nunca confie em cabeçalhos ou cookies não assinados. Implemente desafios multi-fator e revogue credenciais comprometidas rapidamente.

CVE-2023-33140MEDIUMMicrosoft OneNote Spoofing VulnerabilityEPSS 1.6%CVE-2022-35957MEDIUMAuthentication Bypass in Grafana via auth proxy allowing escalation from admin to server adminEPSS 1.6%CVE-2021-28478HIGHMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 1.6%CVE-2025-11250CRITICALAuthentication BypassEPSS 1.6%CVE-2023-35622HIGHWindows DNS Spoofing VulnerabilityEPSS 1.6%CVE-2022-44713HIGHMicrosoft Outlook for Mac Spoofing VulnerabilityEPSS 1.5%CVE-2019-16766HIGH2FA bypass in Wagtail through new device pathEPSS 1.5%CVE-2024-35539MEDIUMTypecho v1.3.0 was discovered to contain a race condition vulnerability in the post commenting function. This vulnerability allows attackersEPSS 1.4%CVE-2021-43807HIGHHTTP Method Spoofing in OpencastEPSS 1.4%CVE-2020-13529MEDIUMAn exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running EPSS 1.4%CVE-2025-56689MEDIUMOne Identity by Quest Safeguard for Privileged Passwords Appliance 7.5.1.20903 is vulnerable to One Time Password (OTP)/Multifactor AuthentiEPSS 1.4%CVE-2022-42983HIGHanji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens.EPSS 1.4%CVE-2022-23949HIGHIn Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar.EPSS 1.4%CVE-2020-26254HIGHomniauth-apple allows attacker to fake their email address during authenticationEPSS 1.3%CVE-2020-2002HIGHPAN-OS: Spoofed Kerberos key distribution center authentication bypassEPSS 1.3%CVE-2023-51350CRITICALA spoofing attack in ujcms v.8.0.2 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script EPSS 1.3%CVE-2024-13061CRITICAL2100 Technology Electronic Official Document Management System - Authentication BypassEPSS 1.3%CVE-2022-29218HIGHUnauthorized takeover for new versions of some platform-specific gemsEPSS 1.3%CVE-2021-26418MEDIUMMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 1.2%CVE-2022-31149HIGHActivityWatch vulnerable to DNS rebinding attackEPSS 1.2%