Weaknesses of type CWE-346

587 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2023-2589MEDIUMAn issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before EPSS 0.4%CVE-2026-22794CRITICALAccount Takeover Vulnerability in AppsmithEPSS 0.4%CVE-2024-25996MEDIUMPHOENIX CONTACT: Remote code execution due to an origin validation error in CHARX Series EPSS 0.4%CVE-2022-50925HIGHProwise Reflect v1.0.9 - Remote Keystroke InjectionEPSS 0.4%CVE-2026-59971CRITICALMySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)EPSS 0.4%CVE-2026-47691HIGHNetty has Insufficient Bailiwick Validation for NS RecordsEPSS 0.4%CVE-2026-2611CRITICALImproper Origin Validation in mlflow/mlflowEPSS 0.4%CVE-2023-2639MEDIUMRockwell Automation FactoryTalk System Services Vulnerable to Sensitive Information DisclosureEPSS 0.4%CVE-2024-57965NONEIn axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted sEPSS 0.4%CVE-2026-43870HIGHApache Thrift: Node.js web_server.js multi-vulnerabilityEPSS 0.4%CVE-2024-10534HIGHImproper Access Control in Dataprom Informatics' PACS-ACSSEPSS 0.4%CVE-2022-38472MEDIUMAn attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the adEPSS 0.4%CVE-2026-46409CRITICALOpenYak local API: unauthenticated CSRF chain leads to Remote Code ExecutionEPSS 0.4%CVE-2022-3457LOWOrigin Validation Error in ikus060/rdiffwebEPSS 0.4%CVE-2026-25604MEDIUMApache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication BypassEPSS 0.4%CVE-2026-86466HIGHApache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validatedEPSS 0.4%CVE-2025-71214HIGHAn origin validation error vulnerability in the Trend Micro Apex One (mac) agent iCore service could allow a local attacker to escalate privEPSS 0.4%CVE-2024-44734HIGHIncorrect access control in Mirotalk before commit 9de226 allows attackers to arbitrarily change usernames via sending a crafted roomAction EPSS 0.4%CVE-2026-62316HIGHMicrosoft UFO: DNS Rebinding → Unauthenticated File Read / Command ExecutionEPSS 0.4%CVE-2022-46718—A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, macOS Big SEPSS 0.4%