Weaknesses of type CWE-290

721 results

Autenticação insuficiente contra falsificação de identidade

Ocorre quando o mecanismo de autenticação falha em validar corretamente a identidade do usuário ou cliente, permitindo que um atacante se passe por outra pessoa. A implementação não implementa verificações robustas (como criptografia, assinaturas digitais ou desafios aleatórios), deixando a autenticação vulnerável a spoofing.

Example

Um sistema de API que valida usuários apenas pelo campo 'nome de usuário' em um cabeçalho HTTP sem usar token, sessão ou assinatura criptográfica — um atacante altera o header e acessa dados de outros usuários. Ou um protocolo que aceita certificados autoassinados sem verificar a cadeia de confiança, autenticando servidores falsos.

How to mitigate

Use mecanismos de autenticação estabelecidos e testados: tokens JWT com assinatura, OAuth 2.0, ou mTLS. Sempre valide criptograficamente a identidade do cliente, nunca confie em cabeçalhos ou cookies não assinados. Implemente desafios multi-fator e revogue credenciais comprometidas rapidamente.

CVE-2025-13636MEDIUMInappropriate implementation in Split View in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage EPSS 0.2%CVE-2026-54763HIGHTraefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuthEPSS 0.2%CVE-2026-94457MEDIUMWordPress Captcha Code plugin <= 3.32 - Bypass Vulnerability vulnerabilityEPSS 0.2%CVE-2026-73449MEDIUMOn affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADIEPSS 0.2%CVE-2026-123587HIGHHickory-DNS 0.26.0 before 0.26.2 DNSSEC Nonexistence Forgery via Wraparound NSECEPSS 0.2%CVE-2026-91914HIGHDell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerability. An unauthenticated attackeEPSS 0.2%CVE-2026-90465HIGHFireware OS Missing Authentication in FireCluster Sync Allows Privilege EscalationEPSS 0.2%CVE-2024-44104HIGHAn incorrectly implemented authentication scheme that is subjected to a spoofing attack in the management console of Ivanti Workspace ControEPSS 0.2%CVE-2026-82563HIGHSoftish C6 Ear Camera and EarVision Android Application Authentication bypass by spoofingEPSS 0.2%CVE-2023-5616MEDIUMIn Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activaEPSS 0.2%CVE-2025-59154MEDIUMOpenfire allows potential identity spoofing via unsafe CN parsingEPSS 0.2%CVE-2024-30191HIGHA vulnerability has been identified in SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0), SCALANCE W1748-1 M12 (6GK5748-1GY01-0TA0), SCALANCE W1788-EPSS 0.2%CVE-2026-90717CRITICALDell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1EPSS 0.2%CVE-2026-20071LOWISE 802.1x Session Hijack VulnerabilityEPSS 0.2%CVE-2026-103347MEDIUMWordPress hCaptcha for WP plugin <= 5.3.0 - Bypass Vulnerability vulnerabilityEPSS 0.2%CVE-2025-13015LOWSpoofing issue in FirefoxEPSS 0.2%CVE-2025-60868MEDIUMThe Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enablEPSS 0.2%CVE-2026-117656CRITICALUnverified Sign in with Apple callback parameter can override verified ID token claimsEPSS 0.2%CVE-2026-53857HIGHOpenClaw < 2026.5.3 - Mutable Display Name Binding in Zalo allowFrom PolicyEPSS 0.2%CVE-2023-27199—PAX Technology A930 PayDroid_7.1.1_Virgo_V04.5.02_20220722 allows attackers to compile a malicious shared library and use LD_PRELOAD to bypaEPSS 0.2%