Weaknesses of type CWE-346

589 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2026-81102LOWDropbox Dash MCP Server DNS Rebinding via Missing Host Header ValidationEPSS 0.1%CVE-2026-91201MEDIUMDocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessageEPSS 0.1%CVE-2026-47825HIGHSpring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situationsEPSS 0.1%CVE-2026-84482HIGHWWBN AVideo Cross-Site Request Forgery via get_domain() validationEPSS 0.1%CVE-2026-69245MEDIUMGuzzle: Noncanonical cookie domain keeps subdomain scopeEPSS 0.1%CVE-2026-44698HIGHHome Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injectionEPSS 0.1%CVE-2026-35568HIGHMCP Java-SDK has a DNS Rebinding VulnerabilityEPSS 0.1%CVE-2026-40622MEDIUMAnother 'ghost domain names' attack variantEPSS 0.1%CVE-2026-28403HIGHTextream Cross-Site WebSocket Hijacking (CSWSH) vulnerabilityEPSS 0.1%CVE-2026-74974MEDIUMSame-origin policy bypass in the Graphics: ImageLib componentEPSS 0.1%CVE-2026-5899MEDIUMInsufficient policy enforcement in History Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a userEPSS 0.1%CVE-2025-61740HIGHJohnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation ErrorEPSS 0.1%CVE-2026-41057HIGHAVideo has CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) that Exposes Authenticated API ResponsesEPSS 0.1%CVE-2026-22694MEDIUMAliasVault is Missing Origin Validation in Android Passkey Credential ProviderEPSS 0.1%CVE-2026-11309MEDIUMInsufficient policy enforcement in History in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crEPSS 0.1%CVE-2026-54605HIGHOAuth: Cross-origin token-request redirects can expose signed request metadataEPSS 0.1%CVE-2026-18016MEDIUMInsufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoEPSS 0.1%CVE-2026-23792MEDIUMAn issue was discovered in NR RRC in Samsung Mobile Processor and Modem Exynos 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, WEPSS 0.1%CVE-2021-26735MEDIUMUntrusted Search Path While Executing REG DELETE by UninstallerEPSS 0.1%CVE-2026-12284LOWMattermost Desktop App Missing IPC Sender Validation in Calls Leave HandlerEPSS 0.1%