Weaknesses of type CWE-346

698 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2024-23458HIGHLocal Privilege Escalation on Zscaler Client Connector on WindowsEPSS 0.1%CVE-2026-34460MEDIUMNamelessMC: OAuth callback `state` is not validated, allowing login CSRF / session swappingEPSS 0.1%CVE-2026-83813LOWTwisted: DNS Response Spoofing in twisted.names Due to Missing Source Address ValidationEPSS 0.1%CVE-2026-94486LOWNext.js: Information disclosure in the Next.js development server's Model Context Protocol endpointEPSS 0.1%CVE-2026-100598HIGHOpenClaw before 2026.7.1 Approval Binding Logic ErrorEPSS 0.1%CVE-2026-6339MEDIUMMissing request origin validation on burn-on-read reveal endpointEPSS 0.1%CVE-2021-26737MEDIUMPrivilege Escalation Using PID Reuse in ZCC macOSEPSS 0.1%CVE-2026-97155MEDIUMFabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, doEPSS 0.1%CVE-2026-123499MEDIUMVikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml ServerEPSS 0.1%CVE-2026-2457MEDIUMWebSocket Message Spoofing via Permalink Embed ManipulationEPSS 0.1%CVE-2026-42558HIGHXibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSetEPSS 0.1%CVE-2026-41398LOWOpenClaw - Unauthorized Agent Request Dispatch via Untrusted Local-Network Pages in iOS A2UI BridgeEPSS 0.1%CVE-2026-44755MEDIUMEmail Spoofing vulnerability in SAP Business Objects Business Intelligence PlatformEPSS 0.1%CVE-2026-46685MEDIUMRustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on consoleEPSS 0.1%CVE-2026-9989MEDIUMInappropriate implementation in Media in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to bypass same origin policy via a EPSS 0.1%CVE-2024-31127HIGHMacOS Zscaler Client Connector Local Privilege EscalationEPSS 0.1%CVE-2023-25188MEDIUMAn issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. If/when CSP (as a BTS administrator) removes security hardeniEPSS 0.1%CVE-2026-92068MEDIUMSite isolation issue in the Reader Mode componentEPSS 0.1%CVE-2026-34720LOWZammad has an origin validation error in SSO mechanismEPSS 0.1%CVE-2026-41886HIGHlocize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext EditorEPSS 0.1%