Weaknesses of type CWE-346

696 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2026-69559MEDIUMMicrosoft Teams for Android Information Disclosure VulnerabilityEPSS 0.3%CVE-2024-6844MEDIUMInconsistent CORS Matching Due to Handling of '+' in URL Path in corydolphin/flask-corsEPSS 0.3%CVE-2026-88132MEDIUMAzure Key Vault Information Disclosure VulnerabilityEPSS 0.3%CVE-2024-8024HIGHCORS Misconfiguration in netease-youdao/qanythingEPSS 0.3%CVE-2025-30466CRITICALThis issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4EPSS 0.3%CVE-2026-16442HIGHKeycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restrictionEPSS 0.3%CVE-2026-94243HIGHApache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidenceEPSS 0.3%CVE-2023-49899CRITICALOrigin Validation Error in X-Rite MA-T6EPSS 0.3%CVE-2026-17702LOWInappropriate implementation in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer procEPSS 0.3%CVE-2024-11602HIGHCORS Vulnerability in feast-dev/feastEPSS 0.3%CVE-2025-4839LOWitwanger paicoding CrossUtil.java cross-domain policyEPSS 0.3%CVE-2022-41961MEDIUMBigBlueButton subject to Ineffective user bansEPSS 0.3%CVE-2026-108372HIGHLoopX serve-status permissive CORS policy exposes control-plane state and private Markdown filesEPSS 0.3%CVE-2026-119344CRITICALCocos Intra-handshake attested TLS implementation is vulnerable to Diversion AttacksEPSS 0.3%CVE-2026-42901CRITICALMicrosoft Entra ID Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-16358CRITICALSite isolation issue in the Graphics: WebRender componentEPSS 0.3%CVE-2026-16349CRITICALSame-origin policy bypass in the DOM: Navigation componentEPSS 0.3%CVE-2026-18676MEDIUMKong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost adminEPSS 0.3%CVE-2022-29915MEDIUMThe Performance API did not properly hide the fact whether a request cross-origin resource has observed redirects. This vulnerability affectEPSS 0.3%CVE-2025-24010MEDIUMVite allows any websites to send any requests to the development server and read the responseEPSS 0.3%