Weaknesses of type CWE-346

697 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2026-17895MEDIUMInappropriate implementation in DataTransfer in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engagEPSS 0.2%CVE-2026-17753MEDIUMInappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a cEPSS 0.2%CVE-2026-34930HIGHAn origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. EPSS 0.2%CVE-2026-17731MEDIUMInappropriate implementation in Autofill in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin dEPSS 0.2%CVE-2024-51072MEDIUMAn issue in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to cause a Denial of Service (DoS) via ECEPSS 0.2%CVE-2026-57978MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.2%CVE-2026-121145HIGHInsecure Configuration Vulnerability in Tata Motors iRA and iRA.ev mobile applicationEPSS 0.2%CVE-2026-70309MEDIUMMicrosoft Edge (Chromium-based) Security Feature Bypass VulnerabilityEPSS 0.2%CVE-2026-66317MEDIUMMicrosoft Edge (Chromium-based) Tampering VulnerabilityEPSS 0.2%CVE-2026-66316MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.2%CVE-2026-46728HIGHDas U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.EPSS 0.2%CVE-2025-62584HIGHWhale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment.EPSS 0.2%CVE-2026-13881MEDIUMInappropriate implementation in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policEPSS 0.2%CVE-2026-55767MEDIUMGuzzle: Dot-Only Cookie Domains Match All Hosts in guzzlehttp/guzzleEPSS 0.2%CVE-2026-82438HIGHApache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web OriginsEPSS 0.2%CVE-2026-46701HIGHNetwork-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default SecretEPSS 0.2%CVE-2024-56170MEDIUMA validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI manifests are listings of relevant files that clients aEPSS 0.2%CVE-2023-32993MEDIUMJenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configurEPSS 0.2%CVE-2026-74981HIGHSite isolation issue in the Audio/Video: Web Codecs componentEPSS 0.2%CVE-2026-16375CRITICALSite isolation issue in the Networking: HTTP componentEPSS 0.2%