Weaknesses of type CWE-325

70 results

Etapa Criptográfica Obrigatória Faltando

Ocorre quando o código implementa um protocolo ou mecanismo de segurança, mas omite uma etapa criptográfica essencial do fluxo—como não assinar um dado antes de enviar, não verificar uma assinatura recebida, ou pular a validação de um certificado. Sem essa etapa, a segurança esperada desaba: um atacante pode forjar, modificar ou interceptar dados sem ser detectado.

Example

Um serviço autenticado que valida o token JWT mas esquece de verificar a assinatura dele, acreditando apenas no conteúdo do payload. Um atacante cria seu próprio token com qualquer permissão e ganha acesso total.

How to mitigate

Implemente o protocolo criptográfico completo, seguindo um padrão estabelecido (OAuth 2.0, TLS com validação de certificado, etc.). Faça code review focado em fluxos de segurança e use bibliotecas de criptografia testadas em vez de implementar do zero; adicione testes que forcem a falha se a etapa for pulada.

CVE-2023-40012MEDIUMuthenticode EKU validation bypassEPSS 0.2%CVE-2026-117957HIGHCryptographic issue in the WebRTC: Networking componentEPSS 0.2%CVE-2026-81235HIGHDell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Cryptographic Step vulnerability. A high privileged attacker wEPSS 0.2%CVE-2026-28498HIGHAuthlib: Fail-Open Cryptographic Verification in OIDC Hash BindingEPSS 0.2%CVE-2026-49440HIGHDeno: Miller-Rabin Primality Test Allows Zero RoundsEPSS 0.2%CVE-2026-58638MEDIUMWindows Boot Loader Security Feature Bypass VulnerabilityEPSS 0.2%CVE-2026-96552LOWsfturing hosp_order User Password MD5.java MD5.getMD5 hash without saltEPSS 0.2%CVE-2026-55144HIGHWindows Cryptography API: Next Generation (CNG) Tampering VulnerabilityEPSS 0.2%CVE-2026-16000HIGHKCcmBlockCipher (DSTU 7624 CCM) tag not bound to nonce when no associated data is usedEPSS 0.2%CVE-2026-101294HIGHIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic stepEPSS 0.2%CVE-2026-22863CRITICALDeno node:crypto doesn't finalize cipherEPSS 0.2%CVE-2026-6458MEDIUMAES-256-GCM Authentication Tag Does Not Cover First Ciphertext Blocks When AAD Is EmptyEPSS 0.2%CVE-2026-76784HIGHInsufficient Cryptographic Protections in Local Device Communication Protocol on Multiple TP-Link Kasa Smart Home DevicesEPSS 0.2%CVE-2026-100798HIGHCryptography misuse in Storage: Quota Manager componentEPSS 0.2%CVE-2026-17666CRITICALCryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to bypass discEPSS 0.2%CVE-2026-59776HIGHMissing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips shipped in or before 2017. If the vulnerability is explEPSS 0.2%CVE-2026-48480MEDIUMnetty-incubator-codec-ohttp OHttpVersionChunkDraft's Missing Final-Chunk Enforcement Leads to Undetected Stream TruncationEPSS 0.2%CVE-2015-20112LOWRLPx 5 has two CTR streams based on the same key, IV, and nonce. This can facilitate decryption on a private network.EPSS 0.2%CVE-2025-49600MEDIUMIn MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid signatures if hash computation fails and internal errors go unchecked, EPSS 0.2%CVE-2026-41395HIGHOpenClaw < 2026.3.28 - Webhook Replay via Query Parameter Reordering in Plivo V3EPSS 0.1%