Weaknesses of type CWE-290

721 results

Autenticação insuficiente contra falsificação de identidade

Ocorre quando o mecanismo de autenticação falha em validar corretamente a identidade do usuário ou cliente, permitindo que um atacante se passe por outra pessoa. A implementação não implementa verificações robustas (como criptografia, assinaturas digitais ou desafios aleatórios), deixando a autenticação vulnerável a spoofing.

Example

Um sistema de API que valida usuários apenas pelo campo 'nome de usuário' em um cabeçalho HTTP sem usar token, sessão ou assinatura criptográfica — um atacante altera o header e acessa dados de outros usuários. Ou um protocolo que aceita certificados autoassinados sem verificar a cadeia de confiança, autenticando servidores falsos.

How to mitigate

Use mecanismos de autenticação estabelecidos e testados: tokens JWT com assinatura, OAuth 2.0, ou mTLS. Sempre valide criptograficamente a identidade do cliente, nunca confie em cabeçalhos ou cookies não assinados. Implemente desafios multi-fator e revogue credenciais comprometidas rapidamente.

CVE-2026-87663HIGHAn authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versioEPSS 0.7%CVE-2023-22474HIGHParse Server is vulnerable to authentication bypass via spoofingEPSS 0.7%CVE-2026-105008CRITICALWindows Schannel Spoofing VulnerabilityEPSS 0.7%CVE-2021-27861MEDIUML2 network filtering bypass using stacked VLAN0 and LLC/SNAP headers with invalid lengthsEPSS 0.7%CVE-2026-91039CRITICALdynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeoverEPSS 0.7%CVE-2026-54384CRITICALVitaFit Cloud API Authentication Bypass via POST /front/login/sns/EPSS 0.7%CVE-2024-53862MEDIUMArgo Workflows Allows Access to Archived Workflows with Fake Token in `client` modeEPSS 0.7%CVE-2024-33531HIGHcdbattags lua-resty-jwt 0.2.3 allows attackers to bypass all JWT-parsing signature checks by crafting a JWT with an enc header with the valuEPSS 0.7%CVE-2026-22797CRITICALAn issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.1EPSS 0.7%CVE-2025-49004HIGHHijacking Caido instance during the initial setup via DNS Rebinding to achieve RCEEPSS 0.7%CVE-2018-25318CRITICALTenda FH303/A300 V5.07.68_EN Cookie Session Weakness DNS ChangeEPSS 0.7%CVE-2018-25317CRITICALTenda W3002R/A302/W309R V5.07.64_en Cookie Session Weakness DNS ChangeEPSS 0.7%CVE-2018-25316CRITICALTenda W308R v2 V5.07.48 Cookie Session Weakness DNS ChangeEPSS 0.7%CVE-2024-3843MEDIUMInsufficient data validation in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a craEPSS 0.6%CVE-2026-57489HIGHFileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypassEPSS 0.6%CVE-2026-82117CRITICALAuthentication Bypass by Spoofing Vulnerability in HiRDBEPSS 0.6%CVE-2026-76938CRITICALAuthentication Bypass Vulnerability in JP1/Automatic Job Management System 3EPSS 0.6%CVE-2023-38173MEDIUMMicrosoft Edge for Android Spoofing VulnerabilityEPSS 0.6%CVE-2025-59385HIGHQTS, QuTS heroEPSS 0.6%CVE-2023-20245MEDIUMMultiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DefEPSS 0.6%