Weaknesses of type CWE-346

697 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2026-17883MEDIUMInappropriate implementation in Headless in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via EPSS 0.2%CVE-2026-50168HIGHAngular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist BypassEPSS 0.2%CVE-2023-28794MEDIUMPAC Files Exposed to Internet WebsitesEPSS 0.2%CVE-2026-14057MEDIUMInappropriate implementation in FedCM in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a cEPSS 0.2%CVE-2026-14079MEDIUMInsufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy viEPSS 0.2%CVE-2026-14046MEDIUMInappropriate implementation in CustomTabs in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass same origiEPSS 0.2%CVE-2025-56648MEDIUMnpm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the applicatiEPSS 0.2%CVE-2025-23117MEDIUMAn Insufficient Firmware Update Validation vulnerability could allow an authenticated malicious actor with access to UniFi Protect Cameras aEPSS 0.2%CVE-2025-63386CRITICALA Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpointEPSS 0.2%CVE-2026-52843CRITICALLightpanda: fetch() and XMLHttpRequest attach session cookies to cross-origin requests regardless of credentials modeEPSS 0.2%CVE-2026-66313MEDIUMMicrosoft Edge (Chromium-based) Tampering VulnerabilityEPSS 0.2%CVE-2026-101027HIGHGitea migration SSRF through ALLOWED_DOMAINS address check bypassEPSS 0.2%CVE-2026-54007HIGHOpen WebUI: Cross-origin postMessage confirmation bypass via action:submitEPSS 0.2%CVE-2026-59950HIGHMCP Python SDK: WebSocket server transport does not support Host/Origin validationEPSS 0.2%CVE-2026-14105CRITICALInsufficient policy enforcement in Speech in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy viaEPSS 0.2%CVE-2026-15587CRITICALPrivilege Escalation in Google SecOps (Chronicle SOAR) via Crafted Authentication HeaderEPSS 0.2%CVE-2025-2346MEDIUMIROAD Dash Cam X5/Dash Cam X6 Domain origin validationEPSS 0.2%CVE-2025-9636HIGHCross-Origin Opener Policy Vulnerability in pgAdmin 4EPSS 0.2%CVE-2026-30964MEDIUMWebauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validationEPSS 0.2%CVE-2026-66322HIGHMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.2%