Weaknesses of type CWE-346

698 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2026-79977HIGHWireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in ZephyrEPSS 0.2%CVE-2026-117928HIGHSame-origin policy bypass in the CSS Parsing and Computation componentEPSS 0.2%CVE-2026-16387CRITICALSite isolation issue in the Networking componentEPSS 0.2%CVE-2026-117860HIGHSame-origin policy bypass in the DOM: Navigation componentEPSS 0.2%CVE-2026-121802CRITICAL@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), becEPSS 0.2%CVE-2026-17954MEDIUMPolicy bypass in MHTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted MHTML page.EPSS 0.2%CVE-2026-117966HIGHSite isolation issue in the Networking: HTTP componentEPSS 0.2%CVE-2026-14039MEDIUMInsufficient policy enforcement in GetUserMedia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin poliEPSS 0.2%CVE-2023-27932MEDIUMThis issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, tEPSS 0.2%CVE-2026-17925MEDIUMInappropriate implementation in Cast in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass same origin poliEPSS 0.2%CVE-2023-44189MEDIUMJunos OS Evolved: PTX10003 Series: MAC address validation bypass vulnerabilityEPSS 0.2%CVE-2026-74760HIGHGoogle::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth stateEPSS 0.2%CVE-2026-61742CRITICALDBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL executionEPSS 0.2%CVE-2023-29751MEDIUMAn issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SEPSS 0.2%CVE-2025-21542MEDIUMVulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security).EPSS 0.2%CVE-2026-104056CRITICALCVE-2026-104056EPSS 0.2%CVE-2025-42998MEDIUMSecurity misconfiguration vulnerability in SAP Business One Integration FrameworkEPSS 0.2%CVE-2026-69245MEDIUMGuzzle: Noncanonical cookie domain keeps subdomain scopeEPSS 0.2%CVE-2024-21245MEDIUMVulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions EPSS 0.2%CVE-2026-53499HIGHFORT-validator Vulnerable to RRDP Shared Snapshot Cache PoisoningEPSS 0.2%