Weaknesses of type CWE-346

588 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2026-12032LOWInappropriate implementation in Passwords in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised EPSS 0.2%CVE-2026-17925MEDIUMInappropriate implementation in Cast in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass same origin poliEPSS 0.2%CVE-2024-13068HIGHHost Header Injection in Akinsoft's LimonDeskEPSS 0.2%CVE-2025-52621MEDIUMHCL BigFix SaaS Authentication Service is vulnerable to cache poisoningEPSS 0.2%CVE-2025-69235HIGHWhale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment.EPSS 0.2%CVE-2026-32302HIGHOpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy modeEPSS 0.2%CVE-2026-66322HIGHMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.2%CVE-2026-18000LOWInsufficient policy enforcement in USB in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the EPSS 0.2%CVE-2026-11178MEDIUMInsufficient policy enforcement in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-originEPSS 0.2%CVE-2026-11226MEDIUMInsufficient policy enforcement in PreviewTab in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who convinced a uEPSS 0.2%CVE-2026-17900MEDIUMInappropriate implementation in Enterprise in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to leak cross-originEPSS 0.2%CVE-2026-21790MEDIUMHCL Traveler is susceptible to a weak default HTTP header validation vulnerabilityEPSS 0.1%CVE-2022-29818LOWIn JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawedEPSS 0.1%CVE-2026-11217MEDIUMInappropriate implementation in Fenced Frames in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rendEPSS 0.1%CVE-2026-47265MEDIUMAIOHTTP vulnerable to cross-origin redirect with per-request cookiesEPSS 0.1%CVE-2026-82811MEDIUMToggl OÜ Toggl Track Extension postMessage origin validationEPSS 0.1%CVE-2026-11243MEDIUMInappropriate implementation in Downloads in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictionEPSS 0.1%CVE-2024-12973MEDIUMHost Header Injection in Akinsoft's OctoCloudEPSS 0.1%CVE-2026-16398HIGHSite isolation issue in the Graphics componentEPSS 0.1%CVE-2026-16399HIGHSite isolation issue in the DOM: Navigation componentEPSS 0.1%