Weaknesses of type CWE-290

721 results

Autenticação insuficiente contra falsificação de identidade

Ocorre quando o mecanismo de autenticação falha em validar corretamente a identidade do usuário ou cliente, permitindo que um atacante se passe por outra pessoa. A implementação não implementa verificações robustas (como criptografia, assinaturas digitais ou desafios aleatórios), deixando a autenticação vulnerável a spoofing.

Example

Um sistema de API que valida usuários apenas pelo campo 'nome de usuário' em um cabeçalho HTTP sem usar token, sessão ou assinatura criptográfica — um atacante altera o header e acessa dados de outros usuários. Ou um protocolo que aceita certificados autoassinados sem verificar a cadeia de confiança, autenticando servidores falsos.

How to mitigate

Use mecanismos de autenticação estabelecidos e testados: tokens JWT com assinatura, OAuth 2.0, ou mTLS. Sempre valide criptograficamente a identidade do cliente, nunca confie em cabeçalhos ou cookies não assinados. Implemente desafios multi-fator e revogue credenciais comprometidas rapidamente.

CVE-2026-24013CRITICALApache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPCEPSS 0.6%CVE-2023-20245MEDIUMMultiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DefEPSS 0.6%CVE-2022-38712MEDIUM"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofinEPSS 0.6%CVE-2023-41133MEDIUMWordPress Secure Admin IP plugin <= 2.0 - IP Spoofing vulnerabilityEPSS 0.6%CVE-2023-44463MEDIUMAn issue was discovered in pretix before 2023.7.1. Incorrect parsing of configuration files causes the application to trust unchecked X-ForwEPSS 0.6%CVE-2023-36883MEDIUMMicrosoft Edge for iOS Spoofing VulnerabilityEPSS 0.6%CVE-2024-22519HIGHAn issue discovered in OpenDroneID OSM 3.5.1 allows attackers to impersonate other drones via transmission of crafted data packets.EPSS 0.6%CVE-2023-41329LOWDomain restrictions bypass via DNS Rebinding in WireMock and WireMock StudioEPSS 0.6%CVE-2025-34053MEDIUMAVTECH IP camera, DVR, and NVR Devices Authentication Bypass via .cab Path ManipulationEPSS 0.6%CVE-2026-70179HIGHASP.NET Core Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2022-31738MEDIUMWhen exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user cEPSS 0.6%CVE-2026-42354CRITICALSentry: Improper authentication on SAML SSO process allows user identity linkingEPSS 0.6%CVE-2026-50755CRITICALAn issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the X-Forwarded-For header valueEPSS 0.6%CVE-2019-3884LOWA vulnerability exists in the garbage collection mechanism of atomic-openshift. An attacker able spoof the UUID of a valid object from anothEPSS 0.6%CVE-2026-55652CRITICALWekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)EPSS 0.6%CVE-2025-27671CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Device Impersonation OVE-20230524-0EPSS 0.6%CVE-2023-2807MEDIUMAuthentication bypass in password reset processEPSS 0.6%CVE-2023-23398HIGHMicrosoft Excel Spoofing VulnerabilityEPSS 0.6%CVE-2025-34065MEDIUMAVTECH IP camera, DVR, and NVR Devices Authentication Bypass via /nobody URL PathEPSS 0.6%CVE-2026-49757CRITICALOAuth2/OIDC account takeover in AshAuthentication via email-based user matchingEPSS 0.6%