Weaknesses of type CWE-346

588 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2026-17911MEDIUMInsufficient policy enforcement in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a craEPSS 0.2%CVE-2026-17933MEDIUMInappropriate implementation in DOMStorage in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via aEPSS 0.2%CVE-2026-85152HIGHundici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptorsEPSS 0.2%CVE-2026-37737MEDIUMsanic-cors version 2.2.0 and prior contains an improper regular expression in the try_match() function in sanic_cors/core.py that uses re.maEPSS 0.2%CVE-2026-9595MEDIUMwebpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxiesEPSS 0.2%CVE-2026-17977MEDIUMPolicy bypass in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (CEPSS 0.2%CVE-2026-5321MEDIUMvanna-ai vanna FastAPI/Flask Server cross-domain policyEPSS 0.2%CVE-2026-15587CRITICALPrivilege Escalation in Google SecOps (Chronicle SOAR) via Crafted Authentication HeaderEPSS 0.2%CVE-2024-24782MEDIUMHIMA: Origin Validation Error in multiple productsEPSS 0.2%CVE-2026-11214MEDIUMInappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-originEPSS 0.2%CVE-2026-45173HIGHIdira Identity Browser Extension: Unauthorized Application Interaction via Origin Validation FailureEPSS 0.2%CVE-2022-1747MEDIUMThe authentication mechanism used by voters to activate a voting session on the tested version of Dominion Voting Systems ImageCast X is susEPSS 0.2%CVE-2026-81099HIGHTimescale tiger-slack DNS Rebinding via Disabled Host Header Allow-ListEPSS 0.2%CVE-2026-81100HIGHTimescale tiger-gh-mcp-server DNS Rebinding via Disabled Host Header Allow-ListEPSS 0.2%CVE-2025-53600HIGHWhale browser before 4.32.315.22 allow an attacker to bypass the Same-Origin Policy in a dual-tab environment.EPSS 0.2%CVE-2026-81095HIGHTimescale pg-aiguide through 0.5.0 DNS Rebinding via Disabled Host Header Allow-ListEPSS 0.2%CVE-2025-12905MEDIUMInappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80 allowed a remote attacker to bypass Mark of theEPSS 0.2%CVE-2023-27962MEDIUMA logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. AnEPSS 0.2%CVE-2026-11291MEDIUMInappropriate implementation in Android Autofill in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to bypass sameEPSS 0.2%CVE-2025-59845HIGHApollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypassEPSS 0.2%