Weaknesses of type CWE-346

698 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2024-24782MEDIUMHIMA: Origin Validation Error in multiple productsEPSS 0.2%CVE-2026-45173HIGHIdira Identity Browser Extension: Unauthorized Application Interaction via Origin Validation FailureEPSS 0.2%CVE-2026-11214MEDIUMInappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-originEPSS 0.2%CVE-2025-59845HIGHApollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypassEPSS 0.2%CVE-2026-108362CRITICALPrivasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack)EPSS 0.2%CVE-2026-11291MEDIUMInappropriate implementation in Android Autofill in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to bypass sameEPSS 0.2%CVE-2026-11298MEDIUMInappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass same origiEPSS 0.2%CVE-2023-27962MEDIUMA logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. AnEPSS 0.2%CVE-2022-42860—This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Monterey 12.6.1, macOS Big Sur 1EPSS 0.2%CVE-2026-7643MEDIUMChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policyEPSS 0.2%CVE-2026-12024MEDIUMInsufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote attacker to bypass same origin policy EPSS 0.2%CVE-2026-74934HIGHSite isolation issue in the Graphics: CanvasWebGL componentEPSS 0.2%CVE-2025-69235HIGHWhale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment.EPSS 0.2%CVE-2026-74968MEDIUMSite isolation issue in the Graphics: WebRender componentEPSS 0.2%CVE-2026-92704HIGHSharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process executionEPSS 0.2%CVE-2026-11048MEDIUMInappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malEPSS 0.2%CVE-2026-74970MEDIUMSite isolation issue in the Graphics componentEPSS 0.2%CVE-2026-116592HIGHundici vulnerable to cache poisoning and cross-user disclosure via intermediate redirect hopsEPSS 0.2%CVE-2026-7979MEDIUMInappropriate implementation in Media in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafEPSS 0.2%CVE-2026-41376LOWOpenClaw < 2026.3.31 - Matrix Thread Context Allowlist Bypass via Sender ValidationEPSS 0.2%