Weaknesses of type CWE-346

697 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2026-11624CRITICALThe Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNEPSS 0.2%CVE-2026-114121MEDIUMElectron: openExternal permission requests can be attributed to the wrong originEPSS 0.2%CVE-2025-14279HIGHDNS Rebinding Vulnerability in mlflow/mlflowEPSS 0.2%CVE-2023-29756MEDIUMAn issue found in Twilight v.13.3 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreEPSS 0.2%CVE-2026-44649CRITICALSillyTavern: Authentication Bypass via SSO Header InjectionEPSS 0.2%CVE-2026-112377CRITICALCCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay AttackEPSS 0.2%CVE-2025-11304MEDIUMCodeCanyon/ui-lib Mentor LMS API cross-domain policyEPSS 0.2%CVE-2026-82811MEDIUMToggl OÜ Toggl Track Extension postMessage origin validationEPSS 0.2%CVE-2026-16399HIGHSite isolation issue in the DOM: Navigation componentEPSS 0.2%CVE-2026-16398HIGHSite isolation issue in the Graphics componentEPSS 0.2%CVE-2026-13321HIGHDNSSEC Validation Bypass via Out-of-Zone NSEC Next FieldEPSS 0.2%CVE-2026-81099HIGHTimescale tiger-slack DNS Rebinding via Disabled Host Header Allow-ListEPSS 0.2%CVE-2025-51605HIGHAn issue was discovered in Shopizer 3.2.7. The server's CORS implementation reflects the client-supplied Origin header verbatim into Access-EPSS 0.2%CVE-2026-81100HIGHTimescale tiger-gh-mcp-server DNS Rebinding via Disabled Host Header Allow-ListEPSS 0.2%CVE-2026-16358CRITICALSite isolation issue in the Graphics: WebRender componentEPSS 0.2%CVE-2026-81095HIGHTimescale pg-aiguide through 0.5.0 DNS Rebinding via Disabled Host Header Allow-ListEPSS 0.2%CVE-2024-32642HIGHHost header poisoning allows account takeover via password reset emailEPSS 0.2%CVE-2026-16349CRITICALSame-origin policy bypass in the DOM: Navigation componentEPSS 0.2%CVE-2026-102675HIGHElectron: File and HTTP protocol handlers allow cross-origin reads without corsEnabledEPSS 0.2%CVE-2026-17783MEDIUMInappropriate implementation in Loader in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a craEPSS 0.2%