Weaknesses of type CWE-346

698 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2026-40622MEDIUMAnother 'ghost domain names' attack variantEPSS 0.1%CVE-2026-11278MEDIUMInappropriate implementation in CustomTabs in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to leak cross-origin EPSS 0.1%CVE-2026-41358LOWOpenClaw < 2026.4.2 - Sender Allowlist Bypass via Slack Thread ContextEPSS 0.1%CVE-2026-5899MEDIUMInsufficient policy enforcement in History Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a userEPSS 0.1%CVE-2026-33586MEDIUMAuthenticated SMTP Sender Address ForgeryEPSS 0.1%CVE-2026-85682HIGHYOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST RouteEPSS 0.1%CVE-2026-91132MEDIUMDiscourse: Wildcard iframe origin allowlist bypass via authority separatorsEPSS 0.1%CVE-2026-44698HIGHHome Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injectionEPSS 0.1%CVE-2021-26735MEDIUMUntrusted Search Path While Executing REG DELETE by UninstallerEPSS 0.1%CVE-2026-74974MEDIUMSame-origin policy bypass in the Graphics: ImageLib componentEPSS 0.1%CVE-2026-94111MEDIUMTencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket DaemonEPSS 0.1%CVE-2026-22694MEDIUMAliasVault is Missing Origin Validation in Android Passkey Credential ProviderEPSS 0.1%CVE-2023-47193HIGHAn origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecteEPSS 0.1%CVE-2026-100830HIGHMitigation bypass in the DOM: Navigation componentEPSS 0.1%CVE-2026-59297LOWSpring Cloud Function can incorrectly determine if URI is secureEPSS 0.1%CVE-2026-3846MEDIUMSame-origin policy bypass in the CSS Parsing and Computation componentEPSS 0.1%CVE-2026-101278MEDIUMTrusted Domain Project OpenDMARC PSL Wildcard opendmarc_tld.c : opendmarc_get_tld origin validationEPSS 0.1%CVE-2025-61740HIGHJohnson Controls IQ Panels2, 2+, IQHub, IQPanel 4, PowerG Origin Validation ErrorEPSS 0.1%CVE-2026-105861HIGHPayload external upload trust validation issueEPSS 0.1%CVE-2026-118657MEDIUMEcho: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme HeadersEPSS 0.1%