Weaknesses of type CWE-290

721 results

Autenticação insuficiente contra falsificação de identidade

Ocorre quando o mecanismo de autenticação falha em validar corretamente a identidade do usuário ou cliente, permitindo que um atacante se passe por outra pessoa. A implementação não implementa verificações robustas (como criptografia, assinaturas digitais ou desafios aleatórios), deixando a autenticação vulnerável a spoofing.

Example

Um sistema de API que valida usuários apenas pelo campo 'nome de usuário' em um cabeçalho HTTP sem usar token, sessão ou assinatura criptográfica — um atacante altera o header e acessa dados de outros usuários. Ou um protocolo que aceita certificados autoassinados sem verificar a cadeia de confiança, autenticando servidores falsos.

How to mitigate

Use mecanismos de autenticação estabelecidos e testados: tokens JWT com assinatura, OAuth 2.0, ou mTLS. Sempre valide criptograficamente a identidade do cliente, nunca confie em cabeçalhos ou cookies não assinados. Implemente desafios multi-fator e revogue credenciais comprometidas rapidamente.

CVE-2026-33586MEDIUMAuthenticated SMTP Sender Address ForgeryEPSS 0.1%CVE-2026-44118HIGHOpenClaw < 2026.4.22 - Owner Context Spoofing via Bearer Token HeaderEPSS 0.1%CVE-2026-39411MEDIUMLobeHub has an unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` headerEPSS 0.1%CVE-2025-13455HIGHA vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to bypass ThinkPlus device authEPSS 0.1%CVE-2026-34778MEDIUMElectron: Service worker can spoof executeJavaScript IPC repliesEPSS 0.1%CVE-2026-39959HIGHTmds.DBus: malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of serviceEPSS 0.1%CVE-2026-75509MEDIUMjoserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)EPSS 0.1%CVE-2026-84465HIGHZammad: S/MIME signature verification allows forged sender impersonationEPSS 0.1%CVE-2024-38807MEDIUMCVE-2024-38807: Signature Forgery Vulnerability in Spring Boot's LoaderEPSS 0.1%CVE-2018-25361HIGHSoroush IM Desktop App 0.17.0 Authentication Bypass via Database InjectionEPSS 0.1%CVE-2026-102946CRITICALjoserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_jsonEPSS 0.1%CVE-2026-65399MEDIUMA file quarantine bypass was addressed with additional checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS EPSS 0.1%CVE-2026-91896LOWDell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Authentication Bypass by Spoofing vulnerability. A low privileEPSS 0.1%CVE-2026-107589HIGHAuthentication Bypass by Spoofing in Jacamar CIEPSS 0.1%CVE-2026-6090HIGHA potential authentication bypass was reported in Lenovo Smart Connect for Windows that could allow a local authenticated user to execute arEPSS 0.1%CVE-2025-26428LOWIn startLockTaskMode of LockTaskController.java, there is a possible lock screen bypass due to a logic error in the code. This could lead toEPSS 0.1%CVE-2025-26421MEDIUMIn multiple locations, there is a possible lock screen bypass due to a logic error in the code. This could lead to local escalation of priviEPSS 0.1%CVE-2026-53832HIGHOpenClaw < 2026.5.18 - Identity Header Forgery via Trusted-Proxy ConfigurationEPSS 0.1%CVE-2026-62367HIGHVikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeoverEPSS 0.1%CVE-2025-26419LOWIn initPhoneSwitch of SystemSettingsFragment.java, there is a possible FRP bypass due to a logic error in the code. This could lead to localEPSS 0.1%