Weaknesses of type CWE-290

721 results

Autenticação insuficiente contra falsificação de identidade

Ocorre quando o mecanismo de autenticação falha em validar corretamente a identidade do usuário ou cliente, permitindo que um atacante se passe por outra pessoa. A implementação não implementa verificações robustas (como criptografia, assinaturas digitais ou desafios aleatórios), deixando a autenticação vulnerável a spoofing.

Example

Um sistema de API que valida usuários apenas pelo campo 'nome de usuário' em um cabeçalho HTTP sem usar token, sessão ou assinatura criptográfica — um atacante altera o header e acessa dados de outros usuários. Ou um protocolo que aceita certificados autoassinados sem verificar a cadeia de confiança, autenticando servidores falsos.

How to mitigate

Use mecanismos de autenticação estabelecidos e testados: tokens JWT com assinatura, OAuth 2.0, ou mTLS. Sempre valide criptograficamente a identidade do cliente, nunca confie em cabeçalhos ou cookies não assinados. Implemente desafios multi-fator e revogue credenciais comprometidas rapidamente.

CVE-2026-97249MEDIUMWordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass Vulnerability vulnerabilityEPSS 0.2%CVE-2026-84610MEDIUMA file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS TahoEPSS 0.2%CVE-2024-27853MEDIUMThis issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4. A maliciously crafted ZIP archive may bypass GatekeEPSS 0.2%CVE-2026-32014HIGHOpenClaw < 2026.2.26 - Node Reconnect Metadata Spoofing via Unsigned Platform FieldsEPSS 0.2%CVE-2023-6044MEDIUMA privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker with physical access to impersonate LeEPSS 0.2%CVE-2026-6762MEDIUMSpoofing issue in the DOM: Core & HTML componentEPSS 0.2%CVE-2023-41069MEDIUMThis issue was addressed by improving Face ID anti-spoofing models. This issue is fixed in iOS 17 and iPadOS 17. A 3D model constructed to lEPSS 0.2%CVE-2025-36754CRITICALAuthentication bypass on web interfaceEPSS 0.2%CVE-2026-97308MEDIUMWordPress Login Lockdown plugin <= 2.17 - Bypass Vulnerability vulnerabilityEPSS 0.2%CVE-2025-13635MEDIUMInappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a local attacker to perform UI spoofing via a crafEPSS 0.2%CVE-2026-46731HIGHDell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. EPSS 0.2%CVE-2026-107774MEDIUMDokan < 5.3.3 - Unauthenticated Email Sender Spoofing via Store Contact FormEPSS 0.2%CVE-2026-53833HIGHQQBot for OpenClaw < 2026.4.29 - Authorization Bypass via QQBot Streaming CommandEPSS 0.2%CVE-2026-87670MEDIUMAn authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. The internal gate guarding resEPSS 0.2%CVE-2026-7422HIGHMAC Address Validation Bypass in FreeRTOS-Plus-TCP IPv4 and IPv6 Packet ProcessingEPSS 0.2%CVE-2026-47737HIGHPuma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent ConnectionsEPSS 0.2%CVE-2026-87686MEDIUMAn authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions beforeEPSS 0.2%CVE-2026-39309MEDIUMTrilium Notes: macOS TCC Bypass via Prompt SpoofingEPSS 0.2%CVE-2025-7448HIGHMan in the middle (MitM) attack vulnerability in Wi-SUN libraryEPSS 0.2%CVE-2026-6387HIGHA potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute EPSS 0.2%