Weaknesses of type CWE-346

697 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2026-66322HIGHMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.2%CVE-2026-57112HIGHPraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered toolsEPSS 0.2%CVE-2026-81092HIGHmcp-go before 0.56.0 Missing Host Header Validation Enables DNS RebindingEPSS 0.2%CVE-2026-6508CRITICALRCE in TUBITAK BILGEM's LiderahenkEPSS 0.2%CVE-2026-48063CRITICALBaileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payloadEPSS 0.2%CVE-2026-17916HIGHInsufficient policy enforcement in Settings in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderEPSS 0.2%CVE-2025-63388CRITICALA Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. ThEPSS 0.2%CVE-2026-55438MEDIUMCoder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofingEPSS 0.2%CVE-2026-114456MEDIUMMissing origin validation for the externalbrowser authenticator callback in multiple Snowflake client driversEPSS 0.2%CVE-2026-112101MEDIUMBlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validationEPSS 0.2%CVE-2025-7659HIGHOrigin Validation Error in GitLabEPSS 0.2%CVE-2026-58266MEDIUMAnki: User scripts in iframes have access to the internal Anki APIEPSS 0.2%CVE-2026-11020MEDIUMInappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via aEPSS 0.2%CVE-2026-67448MEDIUMMailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)EPSS 0.2%CVE-2025-10193HIGHNeo4j Cypher MCP server is vulnerable to DNS rebinding attacksEPSS 0.2%CVE-2026-66420HIGHMeshCentral Cross-Site WebSocket Hijacking via Origin Validation Bypass on Self-Signed Certificate DeploymentsEPSS 0.2%CVE-2026-107804MEDIUMNginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockoutEPSS 0.2%CVE-2026-1997MEDIUMCertain HP OfficeJet Pro Printers - Information DisclosureEPSS 0.2%CVE-2026-17977MEDIUMPolicy bypass in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (CEPSS 0.2%CVE-2026-11624CRITICALThe Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNEPSS 0.2%