Weaknesses of type CWE-346

698 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2026-11181MEDIUMInappropriate implementation in Media Session in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policyEPSS 0.1%CVE-2026-116630MEDIUMundici vulnerable to cross-user information disclosure via cross-origin redirect revalidationEPSS 0.1%CVE-2023-23561MEDIUMStormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control: authenticated users can read sensitive information.EPSS 0.1%CVE-2026-35253MEDIUMVulnerability in the Oracle Macoron Tool product of Oracle Open Source Projects. The supported versions that is affected is v0.22.0. Easily EPSS 0.1%CVE-2026-112085HIGHwebpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgradesEPSS 0.1%CVE-2024-12973MEDIUMHost Header Injection in Akinsoft's OctoCloudEPSS 0.1%CVE-2026-10846HIGHInsufficient verification that responses belong to a queryEPSS 0.1%CVE-2025-1102MEDIUMA CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticatEPSS 0.1%CVE-2026-123271MEDIUMChatCLI before v1.215.2 Origin Validation Error via Unvalidated MCP OAuth Resource IndicatorEPSS 0.1%CVE-2026-120987HIGHWhale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment.EPSS 0.1%CVE-2026-105783HIGHJoplin Web Clipper pairing allows cross-origin theft of a permanent API tokenEPSS 0.1%CVE-2026-109286HIGHOpen WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModalEPSS 0.1%CVE-2026-46611MEDIUMGlances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding AttackEPSS 0.1%CVE-2024-54490MEDIUMThis issue was addressed by enabling hardened runtime. This issue is fixed in macOS Sequoia 15.2. A local attacker may gain access to user'sEPSS 0.1%CVE-2026-47703MEDIUMAdGuard Home: DoQ-to-UDP State Reduction and Source-Port OracleEPSS 0.1%CVE-2026-104659HIGHOrigin Validation Error in hMailServerEPSS 0.1%CVE-2026-109332LOWNetwork-AI before 5.15.2 CORS Origin Validation Error in MCP SSE TransportEPSS 0.1%CVE-2026-100821MEDIUMSite isolation issue in the Panning and Zooming componentEPSS 0.1%CVE-2026-44894HIGHNetty's Default QUIC token handler accepts any client-supplied tokenEPSS 0.1%CVE-2026-35568HIGHMCP Java-SDK has a DNS Rebinding VulnerabilityEPSS 0.1%