Weaknesses of type CWE-346

698 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2026-107292MEDIUMPydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` headerEPSS 0.1%CVE-2026-11309MEDIUMInsufficient policy enforcement in History in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crEPSS 0.1%CVE-2026-102673HIGHElectron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTabEPSS 0.1%CVE-2026-41057HIGHAVideo has CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) that Exposes Authenticated API ResponsesEPSS 0.1%CVE-2026-119285MEDIUMFiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin readsEPSS 0.1%CVE-2026-108268CRITICALenclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS sessionEPSS 0.1%CVE-2026-108269CRITICALra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS sessionEPSS 0.1%CVE-2026-100642HIGHSiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuthEPSS 0.1%CVE-2025-2140MEDIUMIBM Engineering Requirements Management Doors Next spoofingEPSS 0.1%CVE-2025-68467LOWDark Reader gives users the ability to request style sheets from local web serversEPSS 0.1%CVE-2026-41342HIGHOpenClaw < 2026.3.28 - Unauthenticated Discovery Endpoint Credential Exfiltration via Remote OnboardingEPSS 0.1%CVE-2026-10010MEDIUMInappropriate implementation in Input in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the EPSS 0.1%CVE-2026-20893HIGHOrigin validation error issue exists in Fujitsu Security Solution AuthConductor Client Basic V2 2.0.25.0 and earlier. If this vulnerability EPSS 0.1%CVE-2026-74967MEDIUMSame-origin policy bypass in the Audio/Video: Playback componentEPSS 0.1%CVE-2026-34777MEDIUMElectron: Incorrect origin passed to permission request handler for iframe requestsEPSS 0.1%CVE-2026-74963MEDIUMSame-origin policy bypass in the Networking: Cookies componentEPSS 0.1%CVE-2026-7005MEDIUMWIT SynApps Runtime 1.4.11 Browser-Mediated SSRF via Controller OnboardingEPSS 0.1%CVE-2026-17984LOWInappropriate implementation in Browser in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin datEPSS 0.1%CVE-2026-116194HIGHRclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth CallbackEPSS 0.1%CVE-2026-6102HIGHMSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation VulnerabilityEPSS 0.1%