Weaknesses of type CWE-305

168 results

Autenticação tecnicamente correta, mas bypassável por fraqueza secundária

A autenticação em si é implementada corretamente, mas há uma falha em outro ponto do código (validação de entrada, gestão de sessão, controle de acesso) que permite contorná-la sem quebrar o mecanismo de autenticação. É quando o algortimo está certo, mas a orquestração dele falha.

Example

Sistema verifica corretamente senha com hash bcrypt, mas aceita também um parâmetro de URL 'admin=true' que não é validado, permitindo bypass direto dos privilégios de autenticação. Ou: autenticação funciona, mas a geração de tokens de sessão usa sequência previsível ou reutiliza IDs antigos.

How to mitigate

Não confie só na função de autenticação isolada: revise toda a cadeia de autorização (validação de entrada, tratamento de sessão, controle de acesso). Faça teste de penetração focado em bypass, não só em quebra de autenticação; implemente múltiplas camadas de validação e nunca deixe parâmetros de privilégio sob controle do cliente.

CVE-2019-14833MEDIUMA flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user EPSS 1.9%CVE-2026-25555CRITICALOpenBullet2 0.3.2 Authentication Bypass via X-Api-Key HeaderEPSS 1.8%CVE-2023-27535MEDIUMAn authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials beiEPSS 1.6%CVE-2023-27536MEDIUMAn authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connectiEPSS 1.6%CVE-2020-24683CRITICALAuthentication Bypass in Symphony PlusEPSS 1.5%CVE-2020-15787—A vulnerability has been identified in SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently validate auEPSS 1.5%CVE-2026-30849CRITICALMantisBT SOAP API has an authentication bypass vulnerability on MySQLEPSS 1.5%CVE-2021-21403HIGHAuthentication Bypass by Primary Weakness in github.com/kongchuanhujiao/serverEPSS 1.4%CVE-2023-27538HIGHAn authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite theEPSS 1.3%CVE-2021-3547—OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unreEPSS 1.2%CVE-2020-15077—OpenVPN Access Server 2.8.7 and earlier versions allows a remote attackers to bypass authentication and access control channel data on serveEPSS 1.2%CVE-2024-34077HIGHMantisBT user account takeover in the signup/reset password processEPSS 1.2%CVE-2021-43175—The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action thEPSS 1.2%CVE-2021-26726HIGHRemote code execution in Valmet DNA before Collection 2021EPSS 1.1%CVE-2022-4722HIGHAuthentication Bypass by Primary Weakness in ikus060/rdiffwebEPSS 1.1%CVE-2024-50478CRITICALWordPress 1-Click Login: Passwordless Authentication plugin 1.4.5 - Broken Authentication vulnerabilityEPSS 1.1%CVE-2019-14909CRITICALA vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or vEPSS 1.1%CVE-2023-1307CRITICALAuthentication Bypass by Primary Weakness in froxlor/froxlorEPSS 1.1%CVE-2019-14910CRITICALA vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS froEPSS 1.1%CVE-2023-27582CRITICALFull authentication bypass if SASL authorization username is specifiedEPSS 1.0%