Weaknesses of type CWE-346

698 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2024-8183HIGHCORS Misconfiguration in prefecthq/prefectEPSS 0.2%CVE-2026-17826LOWInappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker who convinced a userEPSS 0.2%CVE-2025-59957HIGHJunos OS: EX4600 Series and QFX5000 Series: An attacker with physical access can open a persistent backdoorEPSS 0.2%CVE-2026-18000LOWInsufficient policy enforcement in USB in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the EPSS 0.2%CVE-2026-17720LOWInsufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendeEPSS 0.2%CVE-2026-17997LOWInappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendererEPSS 0.2%CVE-2026-17957LOWInappropriate implementation in CORS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer procEPSS 0.2%CVE-2026-17715LOWInappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage iEPSS 0.2%CVE-2026-119331HIGHLadybird: Missing origin-clean enforcement in CSSStyleSheet allows cross-origin CSS read and mutationEPSS 0.2%CVE-2026-11194MEDIUMInappropriate implementation in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crEPSS 0.2%CVE-2026-81102LOWDropbox Dash MCP Server DNS Rebinding via Missing Host Header ValidationEPSS 0.2%CVE-2026-6662MEDIUMericc-ch copilot-api Token Endpoint server.ts cors cross-domain policyEPSS 0.2%CVE-2026-84140CRITICALSite isolation issue in the DOM: Navigation componentEPSS 0.2%CVE-2026-109772CRITICALSame-origin policy bypass in the DevTools componentEPSS 0.2%CVE-2026-63183MEDIUMOmniAuth: Host Header Injection VulnerabilityEPSS 0.2%CVE-2026-61546HIGHAnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP toolsEPSS 0.2%CVE-2026-23792MEDIUMAn issue was discovered in NR RRC in Samsung Mobile Processor and Modem Exynos 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, WEPSS 0.2%CVE-2026-55487HIGHpnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycleEPSS 0.2%CVE-2026-13822MEDIUMInappropriate implementation in Extensions in Google Chrome on Android prior to 150.0.7871.47 allowed an attacker who convinced a user to inEPSS 0.2%CVE-2025-25306CRITICALMisskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated NotesEPSS 0.2%