Weaknesses of type CWE-346

588 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2026-12304CRITICALSame-origin policy bypass in the Networking: Cookies componentEPSS 0.2%CVE-2026-22030MEDIUMReact Router has CSRF issue in Action/Server Action Request ProcessingEPSS 0.2%CVE-2026-6143MEDIUMfarion1231 cc-switch ProxyServer server.rs cross-domain policyEPSS 0.2%CVE-2025-7659HIGHOrigin Validation Error in GitLabEPSS 0.2%CVE-2026-46555HIGHWhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltrationEPSS 0.2%CVE-2026-77119MEDIUMNSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsetsEPSS 0.2%CVE-2025-14331MEDIUMSame-origin policy bypass in the Request Handling componentEPSS 0.2%CVE-2025-59957HIGHJunos OS: EX4600 Series and QFX5000 Series: An attacker with physical access can open a persistent backdoorEPSS 0.2%CVE-2026-84133CRITICALSite isolation issue in the DOM: Push Subscriptions componentEPSS 0.2%CVE-2026-84129CRITICALSite isolation issue in the DOM: Navigation componentEPSS 0.2%CVE-2026-32632MEDIUMGlances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS RebindingEPSS 0.2%CVE-2026-11693HIGHInappropriate implementation in Plugins in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer EPSS 0.2%CVE-2024-45495MEDIUMMSA FieldServer Gateway 5.0.0 through 6.5.2 allows cross-origin WebSocket hijacking.EPSS 0.2%CVE-2025-11304MEDIUMCodeCanyon/ui-lib Mentor LMS API cross-domain policyEPSS 0.2%CVE-2026-11194MEDIUMInappropriate implementation in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crEPSS 0.2%CVE-2026-33314MEDIUMpyload-ng: Improper Authentication and Origin Validation ErrorEPSS 0.2%CVE-2026-27478CRITICALUnity Catalog has a JWT Issuer Validation Bypass Allows Complete User ImpersonationEPSS 0.2%CVE-2026-70599MEDIUMElectron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe OriginEPSS 0.2%CVE-2026-84140CRITICALSite isolation issue in the DOM: Navigation componentEPSS 0.2%CVE-2026-6662MEDIUMericc-ch copilot-api Token Endpoint server.ts cors cross-domain policyEPSS 0.2%