Weaknesses of type CWE-308

23 results

Autenticação de fator único

A aplicação depende apenas de uma forma de verificação de identidade (tipicamente senha) para conceder acesso, sem camadas adicionais como segundo fator. Isso deixa contas vulneráveis se a senha for comprometida por phishing, vazamento ou força bruta, já que não há barreira extra.

Example

Um sistema bancário que exige apenas CPF e senha no login. Se um atacante obtém a senha por phishing, consegue acesso imediato à conta sem precisar passar por autenticação via SMS, token ou biometria.

How to mitigate

Implemente autenticação multifator (2FA) obrigatória — SMS, TOTP, chaves de segurança ou push notifications. Para contas críticas (admin, financeiro), exija sempre um segundo fator independente da senha.

CVE-2023-49075HIGHPimcore Admin UI has Two Factor Authentication disabled for non admin security firewallsEPSS 1.4%CVE-2026-67611HIGHOpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART ConfigurationEPSS 0.8%CVE-2025-42959HIGHMissing Authentication check after implementation of SAP Security Note 3007182 and 3537476EPSS 0.6%CVE-2023-25681MEDIUMIBM Spectrum Virtualize security bypassEPSS 0.6%CVE-2026-56022MEDIUMWebmin MFA bypassEPSS 0.6%CVE-2026-15616CRITICALLocal MFA not enforced during SSO sign-inEPSS 0.5%CVE-2026-58240CRITICALMissing Authentication check in SAP NetWeaver (Message Server)EPSS 0.5%CVE-2026-57490HIGHFileRise: WebDAV authentication bypasses TOTP/MFA entirelyEPSS 0.5%CVE-2026-85590HIGHphpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor DisableEPSS 0.5%CVE-2023-50934MEDIUMIBM PowerSC improper authenticationEPSS 0.4%CVE-2026-107808HIGHNginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)EPSS 0.4%CVE-2024-47652HIGHInsecure Authentication VulnerabilityEPSS 0.4%CVE-2023-34228MEDIUMIn JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actionsEPSS 0.4%CVE-2025-64103HIGHZitadel Bypass Second Authentication FactorEPSS 0.4%CVE-2026-121531MEDIUMUmami 2FA Policy route.ts single-factor authenticationEPSS 0.3%CVE-2026-111884HIGHphpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account TakeoverEPSS 0.3%CVE-2026-45749HIGHTermix's TOTP two-factor authentication can be disabled or bypassed using only the account passwordEPSS 0.3%CVE-2026-79763MEDIUMTermix: MFA-critical operations accept the account password as a sole factor (regression of CVE-2026-45749)EPSS 0.3%CVE-2024-50618MEDIUMA Use of Single-factor Authentication vulnerability in the Authentication component of CIPPlanner CIPAce before 9.17 allows attackers to bypEPSS 0.3%CVE-2024-27928MEDIUMVantage6: 2FA can be circumvented with hacked email accessEPSS 0.3%