Weaknesses of type CWE-346

698 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2025-46737HIGHOrigin Validation ErrorEPSS 0.2%CVE-2026-16381CRITICALSame-origin policy bypass in the Networking: DNS componentEPSS 0.2%CVE-2025-62250MEDIUMImproper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 throEPSS 0.2%CVE-2026-66732HIGHSonic 3 A.I.R. Missing Source Address Validation in ConnectionManagerEPSS 0.2%CVE-2026-92706LOWDark Reader: Ability to request icon-like bitmap data from certain local web serversEPSS 0.2%CVE-2025-5824MEDIUMAutel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass VulnerabilityEPSS 0.2%CVE-2026-35408HIGHDirectus is Missing Cross-Origin Opener PolicyEPSS 0.2%CVE-2026-40594MEDIUMpyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)EPSS 0.2%CVE-2026-107281HIGHAsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identitiesEPSS 0.2%CVE-2025-47909HIGHImproper validation of TrustedOrigins allows CSRF attacks in github.com/gorilla/csrfEPSS 0.2%CVE-2026-34198MEDIUMCoolify: Password reset link poisoning via X-Forwarded-Host header spoofingEPSS 0.2%CVE-2026-7581MEDIUMalexta69 MeTube CORS Policy main.py on_prepare cross-domain policyEPSS 0.2%CVE-2026-28403HIGHTextream Cross-Site WebSocket Hijacking (CSWSH) vulnerabilityEPSS 0.2%CVE-2026-43972MEDIUMgun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injectionEPSS 0.2%CVE-2024-6301MEDIUMOrigin Validation Error in ConduitEPSS 0.2%CVE-2026-54030HIGHLibreChat: Missing Resource Parameter Validation in MCP OAuth FlowEPSS 0.2%CVE-2025-52621MEDIUMHCL BigFix SaaS Authentication Service is vulnerable to cache poisoningEPSS 0.2%CVE-2026-59883MEDIUMGuzzle: Cookie Disclosure and Injection via IP-Address DomainsEPSS 0.2%CVE-2026-76026HIGHOrigin validation error in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin policy via a crafEPSS 0.2%CVE-2026-100803HIGHSame-origin policy bypass in the WebExtensions componentEPSS 0.2%