Weaknesses of type CWE-346

588 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2026-15076HIGHIn versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client doesEPSS 0.2%CVE-2026-13022LOWInappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the rendererEPSS 0.2%CVE-2026-82438HIGHApache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web OriginsEPSS 0.2%CVE-2026-63118MEDIUMMCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protectionEPSS 0.2%CVE-2026-44985HIGHDozzle: Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpoints bypasses authenticationEPSS 0.2%CVE-2026-17854MEDIUMInsufficient policy enforcement in WebMCP in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy viaEPSS 0.2%CVE-2024-21245MEDIUMVulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions EPSS 0.2%CVE-2026-8950CRITICALSame-origin policy bypass in the Networking: HTTP componentEPSS 0.2%CVE-2026-17883MEDIUMInappropriate implementation in Headless in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via EPSS 0.2%CVE-2026-18098HIGHIBM i is Affected By XML injection flaw in Navigator for iEPSS 0.2%CVE-2026-57112HIGHPraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered toolsEPSS 0.2%CVE-2026-73419MEDIUMNextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created themEPSS 0.2%CVE-2025-21542MEDIUMVulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security).EPSS 0.2%CVE-2025-42998MEDIUMSecurity misconfiguration vulnerability in SAP Business One Integration FrameworkEPSS 0.2%CVE-2025-43929MEDIUMopen_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked fEPSS 0.2%CVE-2025-25302HIGHRembg CORS misconfigurationEPSS 0.2%CVE-2026-11195MEDIUMInappropriate implementation in MHTML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in spEPSS 0.2%CVE-2023-29753MEDIUMAn issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows a local attacker to cause a denial of service via the SharedPreferencEPSS 0.2%CVE-2026-81315HIGHMCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto headerEPSS 0.2%CVE-2026-41700HIGHCross-Site WebSocket Hijacking in Spring for GraphQLEPSS 0.2%