Weaknesses of type CWE-346

698 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2026-59152MEDIUMArbitrary server-side file read in LangSmith SDK TracingMiddlewareEPSS 0.2%CVE-2026-102588MEDIUMMoodle: csrf in xml grade importEPSS 0.2%CVE-2026-53499HIGHFORT-validator Vulnerable to RRDP Shared Snapshot Cache PoisoningEPSS 0.2%CVE-2026-108261CRITICALTinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragmentEPSS 0.2%CVE-2026-15076HIGHIn versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client doesEPSS 0.2%CVE-2026-15075HIGHIn Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates alEPSS 0.2%CVE-2026-17900MEDIUMInappropriate implementation in Enterprise in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to leak cross-originEPSS 0.2%CVE-2026-55532HIGHPraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP serverEPSS 0.2%CVE-2026-105769CRITICALkaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hostsEPSS 0.2%CVE-2026-123272MEDIUMmcp-go before v1.2.1 Origin Validation Error via Unvalidated Well-Known Protected Resource MetadataEPSS 0.2%CVE-2026-13022LOWInappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the rendererEPSS 0.2%CVE-2026-32632MEDIUMGlances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS RebindingEPSS 0.2%CVE-2026-18016MEDIUMInsufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoEPSS 0.2%CVE-2026-110737LOWPush Endpoint Returns Permissive CORS HeadersEPSS 0.2%CVE-2024-45495MEDIUMMSA FieldServer Gateway 5.0.0 through 6.5.2 allows cross-origin WebSocket hijacking.EPSS 0.2%CVE-2026-117976HIGHSite isolation issue in the DOM: Navigation componentEPSS 0.2%CVE-2026-117958HIGHSite isolation issue in the Networking: HTTP componentEPSS 0.2%CVE-2026-8950CRITICALSame-origin policy bypass in the Networking: HTTP componentEPSS 0.2%CVE-2025-25302HIGHRembg CORS misconfigurationEPSS 0.2%CVE-2026-70599MEDIUMElectron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe OriginEPSS 0.2%