Weaknesses of type CWE-290

606 results

Autenticação insuficiente contra falsificação de identidade

Ocorre quando o mecanismo de autenticação falha em validar corretamente a identidade do usuário ou cliente, permitindo que um atacante se passe por outra pessoa. A implementação não implementa verificações robustas (como criptografia, assinaturas digitais ou desafios aleatórios), deixando a autenticação vulnerável a spoofing.

Example

Um sistema de API que valida usuários apenas pelo campo 'nome de usuário' em um cabeçalho HTTP sem usar token, sessão ou assinatura criptográfica — um atacante altera o header e acessa dados de outros usuários. Ou um protocolo que aceita certificados autoassinados sem verificar a cadeia de confiança, autenticando servidores falsos.

How to mitigate

Use mecanismos de autenticação estabelecidos e testados: tokens JWT com assinatura, OAuth 2.0, ou mTLS. Sempre valide criptograficamente a identidade do cliente, nunca confie em cabeçalhos ou cookies não assinados. Implemente desafios multi-fator e revogue credenciais comprometidas rapidamente.

CVE-2025-34065MEDIUMAVTECH IP camera, DVR, and NVR Devices Authentication Bypass via /nobody URL PathEPSS 0.6%CVE-2025-49004HIGHHijacking Caido instance during the initial setup via DNS Rebinding to achieve RCEEPSS 0.6%CVE-2024-35538MEDIUMTypecho v1.3.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specifyEPSS 0.6%CVE-2022-36331CRITICALImpersonation attack causing an Authentication Bypass on Western Digital devicesEPSS 0.6%CVE-2025-34063CRITICALOneLogin AD Connector JWT Authentication Bypass via Exposed Signing KeyEPSS 0.6%CVE-2023-44447MEDIUMTP-Link TL-WR902AC loginFs Improper Authentication Information Disclosure VulnerabilityEPSS 0.6%CVE-2023-2001MEDIUMAn issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all verEPSS 0.6%CVE-2022-31738MEDIUMWhen exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user cEPSS 0.6%CVE-2025-30144MEDIUMFast-JWT Improperly Validates iss ClaimsEPSS 0.6%CVE-2026-49231LOWApache APISIX: Identity spoofing issue in APISIX opa pluginEPSS 0.6%CVE-2023-3103HIGHAuthentication Bypass by Spoofing in Unitree Robotics A1EPSS 0.6%CVE-2020-37056MEDIUMCrystal Shard http-protection 0.2.0 - IP Spoofing BypassEPSS 0.6%CVE-2025-13953CRITICALBypass in the authentication method of the GTT Sistema de Información Tributario applicationEPSS 0.6%CVE-2026-7507HIGHOrg.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeoverEPSS 0.6%CVE-2023-20256MEDIUMMultiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DefEPSS 0.6%CVE-2021-21492MEDIUMSAP NetWeaver Application Server Java(HTTP Service), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate logEPSS 0.6%CVE-2023-20246MEDIUMMultiple Cisco products are affected by a vulnerability in Snort access control policies that could allow an unauthenticated, remote attackeEPSS 0.6%CVE-2026-85751CRITICALMailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trustEPSS 0.6%CVE-2020-22660HIGHIn Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, RuckusEPSS 0.6%CVE-2026-76423CRITICALCisco ISE API Authentication Bypass VulnerabilityEPSS 0.5%