Weaknesses of type CWE-346

588 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2026-52843CRITICALLightpanda: fetch() and XMLHttpRequest attach session cookies to cross-origin requests regardless of credentials modeEPSS 0.2%CVE-2026-56179HIGHWindows Network Address Translation (NAT) Spoofing VulnerabilityEPSS 0.2%CVE-2026-54007HIGHOpen WebUI: Cross-origin postMessage confirmation bypass via action:submitEPSS 0.2%CVE-2026-14105CRITICALInsufficient policy enforcement in Speech in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy viaEPSS 0.2%CVE-2026-59950HIGHMCP Python SDK: WebSocket server transport does not support Host/Origin validationEPSS 0.2%CVE-2025-23117MEDIUMAn Insufficient Firmware Update Validation vulnerability could allow an authenticated malicious actor with access to UniFi Protect Cameras aEPSS 0.2%CVE-2026-18676MEDIUMKong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost adminEPSS 0.2%CVE-2026-2790HIGHSame-origin policy bypass in the Networking: JAR componentEPSS 0.2%CVE-2026-92359LOWag-ui-protocol ag-ui CORSMiddleware utils.py create_strands_app cross-domain policyEPSS 0.2%CVE-2026-17783MEDIUMInappropriate implementation in Loader in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a craEPSS 0.2%CVE-2026-17817MEDIUMInappropriate implementation in ReportingAndNEL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data EPSS 0.2%CVE-2026-17833MEDIUMInappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a EPSS 0.2%CVE-2026-17823MEDIUMInsufficient policy enforcement in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via EPSS 0.2%CVE-2026-46701HIGHNetwork-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default SecretEPSS 0.2%CVE-2026-13321HIGHDNSSEC Validation Bypass via Out-of-Zone NSEC Next FieldEPSS 0.2%CVE-2025-2346MEDIUMIROAD Dash Cam X5/Dash Cam X6 Domain origin validationEPSS 0.2%CVE-2025-63388CRITICALA Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. ThEPSS 0.2%CVE-2026-6508CRITICALRCE in TUBITAK BILGEM's LiderahenkEPSS 0.2%CVE-2026-55438MEDIUMCoder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofingEPSS 0.2%CVE-2025-10193HIGHNeo4j Cypher MCP server is vulnerable to DNS rebinding attacksEPSS 0.2%