Weaknesses of type CWE-345

557 results

Verificação Insuficiente da Autenticidade de Dados

O software recebe dados de uma fonte externa (requisição HTTP, arquivo, API, mensagem) mas não valida adequadamente se eles realmente vêm de quem diz vir, ou se não foram alterados no caminho. Isso permite que um atacante falsifique ou modifique dados e o sistema os processe como legítimos, causando desde injeção de código até manipulação de lógica de negócio.

Example

Uma API de pagamento que recebe um JSON com status='pagamento confirmado' mas não verifica assinatura HMAC ou JWT. Um atacante intercepta a resposta, altera o status para 'aprovado' e envia de volta; o servidor processa como válido. Outro caso: um formulário que aceita um 'user_id' do cliente sem validar se aquele usuário é quem está fazendo a requisição.

How to mitigate

Use assinaturas criptográficas (HMAC-SHA256, RSA, ECDSA) ou tokens assinados (JWT) para dados críticos; valide origem com CORS e referer headers; nunca confie em dados do cliente sem verificação no servidor; implemente rate limiting e detecção de anomalias para detectar tentativas de manipulação em tempo real.

CVE-2026-45337HIGHBetter Auth: Device authorization approve and deny accept any authenticated session while the user code is pendingEPSS 0.2%CVE-2024-47867LOWLack of integrity check on the downloaded FRP client in GradioEPSS 0.2%CVE-2026-35039CRITICALfast-jwt Affected by Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)EPSS 0.2%CVE-2026-50575HIGHBetterDesk has a replay behavior vulnerability when devices are deletedEPSS 0.2%CVE-2024-40644MEDIUMgitoxide's gix-path can use a fake program files locationEPSS 0.2%CVE-2023-43800HIGHInsufficient Verification of Data Authenticity in Arduino Create AgentEPSS 0.2%CVE-2025-1108HIGHInsufficient data authenticity vulnerability in JantoEPSS 0.2%CVE-2023-28457HIGHAn issue was discovered in Technitium through 11.0.3. It enables attackers to conduct a DNS cache poisoning attack and inject fake responsesEPSS 0.2%CVE-2026-44434MEDIUMQuicly is vulnerable to stateless reset injectionEPSS 0.2%CVE-2026-54581HIGHmport bootstrap index fetch can continue after hash verification failureEPSS 0.2%CVE-2026-48781CRITICALPostiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgeryEPSS 0.2%CVE-2019-10157MEDIUMIt was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backEPSS 0.2%CVE-2026-54239HIGHFaustWP — Authentication Bypass via Initialization Vector Modification in Token EnvelopeEPSS 0.2%CVE-2026-55430MEDIUMCoder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data accessEPSS 0.2%CVE-2019-1880MEDIUMCisco Unified Computing System BIOS Signature Bypass VulnerabilityEPSS 0.2%CVE-2026-54763HIGHTraefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuthEPSS 0.2%CVE-2023-44402MEDIUMASAR Integrity bypass via filetype confusion in electronEPSS 0.2%CVE-2026-18248CRITICAL@fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event headerEPSS 0.2%CVE-2026-25474HIGHOpenClaw has a Telegram webhook request forgery (missing `channels.telegram.webhookSecret`) → auth bypassEPSS 0.2%CVE-2026-30920HIGHOneUptime has broken access control in GitHub App installation flow that allows unauthorized project bindingEPSS 0.2%