Weaknesses of type CWE-346

697 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2026-44985HIGHDozzle: Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpoints bypasses authenticationEPSS 0.2%CVE-2026-84482HIGHWWBN AVideo Cross-Site Request Forgery via get_domain() validationEPSS 0.2%CVE-2026-11133MEDIUMInsufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via EPSS 0.2%CVE-2026-11132MEDIUMInsufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via EPSS 0.2%CVE-2026-92360MEDIUMag-ui-protocol ag-ui Event Application Layer agent.ts prepareRunAgentInput origin validationEPSS 0.2%CVE-2026-27478CRITICALUnity Catalog has a JWT Issuer Validation Bypass Allows Complete User ImpersonationEPSS 0.2%CVE-2026-91201MEDIUMDocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessageEPSS 0.2%CVE-2026-46555HIGHWhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltrationEPSS 0.2%CVE-2026-118651MEDIUMEcho: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by DefaultEPSS 0.2%CVE-2026-8971MEDIUMSame-origin policy bypass in the Networking: JAR componentEPSS 0.2%CVE-2024-45354MEDIUMxiaomi shop application Webview has code execution vulnerabilityEPSS 0.2%CVE-2024-28883HIGHBIG-IP APM browser network access VPN client vulnerabilityEPSS 0.2%CVE-2026-82121HIGHOrigin Validation Error Vulnerability in HiRDBEPSS 0.2%CVE-2026-34373MEDIUMParse Server: GraphQL API endpoint ignores CORS origin restrictionEPSS 0.2%CVE-2024-2377HIGHA vulnerability exists in the too permissive HTTP response header web server settings of the SDM600. An attacker can take advantage of this EPSS 0.2%CVE-2026-26861HIGHCleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS) via window.postMessage. The handleCustomHtmlPreviewEPSS 0.2%CVE-2026-117965HIGHSame-origin policy bypass in the Address Bar componentEPSS 0.2%CVE-2026-79977HIGHWireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in ZephyrEPSS 0.2%CVE-2026-117860HIGHSame-origin policy bypass in the DOM: Navigation componentEPSS 0.2%CVE-2026-13034MEDIUMInappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the rendereEPSS 0.2%