Weaknesses of type CWE-290

721 results

Autenticação insuficiente contra falsificação de identidade

Ocorre quando o mecanismo de autenticação falha em validar corretamente a identidade do usuário ou cliente, permitindo que um atacante se passe por outra pessoa. A implementação não implementa verificações robustas (como criptografia, assinaturas digitais ou desafios aleatórios), deixando a autenticação vulnerável a spoofing.

Example

Um sistema de API que valida usuários apenas pelo campo 'nome de usuário' em um cabeçalho HTTP sem usar token, sessão ou assinatura criptográfica — um atacante altera o header e acessa dados de outros usuários. Ou um protocolo que aceita certificados autoassinados sem verificar a cadeia de confiança, autenticando servidores falsos.

How to mitigate

Use mecanismos de autenticação estabelecidos e testados: tokens JWT com assinatura, OAuth 2.0, ou mTLS. Sempre valide criptograficamente a identidade do cliente, nunca confie em cabeçalhos ou cookies não assinados. Implemente desafios multi-fator e revogue credenciais comprometidas rapidamente.

CVE-2026-93538HIGHCross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in FleetEPSS 0.2%CVE-2026-88819MEDIUMIn Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.EPSS 0.2%CVE-2025-13634MEDIUMInappropriate implementation in Downloads in Google Chrome on Windows prior to 143.0.7499.41 allowed a local attacker to bypass mark of the EPSS 0.2%CVE-2025-54305HIGHAn issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. One of the middlewares included in this application, LEPSS 0.2%CVE-2026-112493HIGHA downgrade issue was addressed with additional version checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS TEPSS 0.2%CVE-2026-112444MEDIUMThis issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An app may be able to bypaEPSS 0.2%CVE-2026-31813MEDIUMSupabase Auth has insecure Apple and Azure authentication with ID tokensEPSS 0.2%CVE-2023-7169MEDIUMImpersonate vendor signed Powershell scriptsEPSS 0.2%CVE-2026-75037HIGHPolkit authentication bypass in LACTEPSS 0.2%CVE-2026-28900MEDIUMA file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS TahoeEPSS 0.2%CVE-2026-112494MEDIUMA file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An app mayEPSS 0.2%CVE-2026-28849MEDIUMThe issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. A maliciouEPSS 0.2%CVE-2025-37147HIGHSecure Boot Bypass allows for Compromise of Hardware Root of TrustEPSS 0.2%CVE-2026-33246MEDIUMNATS: Leafnode connections allow spoofing of Nats-Request-Info identity headersEPSS 0.1%CVE-2026-59916HIGHDell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileEPSS 0.1%CVE-2026-84790HIGHOpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject fieldEPSS 0.1%CVE-2026-47123HIGHFreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID PathEPSS 0.1%CVE-2026-61217MEDIUMVulnerability in the Oracle Security Service product of Oracle Fusion Middleware (component: Oracle SSL API). The supported version that iEPSS 0.1%CVE-2026-63115MEDIUMActivityPub Undo handler can unfollow or remove reposts on behalf of other accountsEPSS 0.1%CVE-2025-27389MEDIUMApplication Installation Source Verification Flaw May Lead to Risk Detection BypassEPSS 0.1%