Weaknesses of type CWE-290

721 results

Autenticação insuficiente contra falsificação de identidade

Ocorre quando o mecanismo de autenticação falha em validar corretamente a identidade do usuário ou cliente, permitindo que um atacante se passe por outra pessoa. A implementação não implementa verificações robustas (como criptografia, assinaturas digitais ou desafios aleatórios), deixando a autenticação vulnerável a spoofing.

Example

Um sistema de API que valida usuários apenas pelo campo 'nome de usuário' em um cabeçalho HTTP sem usar token, sessão ou assinatura criptográfica — um atacante altera o header e acessa dados de outros usuários. Ou um protocolo que aceita certificados autoassinados sem verificar a cadeia de confiança, autenticando servidores falsos.

How to mitigate

Use mecanismos de autenticação estabelecidos e testados: tokens JWT com assinatura, OAuth 2.0, ou mTLS. Sempre valide criptograficamente a identidade do cliente, nunca confie em cabeçalhos ou cookies não assinados. Implemente desafios multi-fator e revogue credenciais comprometidas rapidamente.

CVE-2022-25989HIGHAn authentication bypass vulnerability exists in the libxm_av.so getpeermac() functionality of Anker Eufy Homebase 2 2.1.8.5h. A specially-cEPSS 1.0%CVE-2024-34145HIGHA sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in Jenkins Script SecurityEPSS 1.0%CVE-2023-42843HIGHAn inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 16.7.2 and iPadOS 16.7.2, iOS EPSS 1.0%CVE-2023-24935MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 1.0%CVE-2022-0030HIGHPAN-OS: Authentication Bypass in Web InterfaceEPSS 1.0%CVE-2025-21415CRITICALAzure AI Face Service Elevation of Privilege VulnerabilityEPSS 1.0%CVE-2024-51504CRITICALApache ZooKeeper: Authentication bypass with IP-based authentication in Admin ServerEPSS 0.9%CVE-2026-69843CRITICALMicrosoft Fabric Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2023-31424HIGHWeb authentication and authorization bypassEPSS 0.9%CVE-2024-32977HIGHOctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabledEPSS 0.9%CVE-2022-47522HIGHThe IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept (possibly cleartext) target-destined frameEPSS 0.9%CVE-2020-11015HIGHDevice Authentication Vulnerability in thinx-device-api IoT Device Management ServerEPSS 0.9%CVE-2026-45489MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.9%CVE-2019-3775HIGHUAA allows users to modify their own email addressEPSS 0.9%CVE-2024-29006CRITICALApache CloudStack: x-forwarded-for HTTP header parsed by defaultEPSS 0.9%CVE-2020-2033MEDIUMGlobalProtect App: Missing certificate validation vulnerability can disclose pre-logon authentication cookieEPSS 0.9%CVE-2026-108131HIGHActive Directory Federation Services (AD FS) Spoofing VulnerabilityEPSS 0.9%CVE-2026-25119HIGHGogs: Authentication Bypass via Unvalidated Reverse Proxy HeadersEPSS 0.9%CVE-2025-5605MEDIUMAuthentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information DisclosureEPSS 0.9%CVE-2026-7507HIGHOrg.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeoverEPSS 0.8%