Weaknesses of type CWE-346

588 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2026-17763MEDIUMInappropriate implementation in GPU in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer proceEPSS 0.3%CVE-2026-17733MEDIUMInappropriate implementation in QUIC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data EPSS 0.3%CVE-2026-17788MEDIUMInappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafEPSS 0.3%CVE-2026-32634HIGHGlances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed ServersEPSS 0.3%CVE-2026-17820MEDIUMInsufficient policy enforcement in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via EPSS 0.3%CVE-2026-17775MEDIUMInappropriate implementation in PresentationAPI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data EPSS 0.3%CVE-2026-17798MEDIUMInappropriate implementation in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a craftEPSS 0.3%CVE-2026-17731MEDIUMInappropriate implementation in Autofill in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin dEPSS 0.3%CVE-2024-45352HIGHXiaomi smarthome application Webview has code execution vulnerabilityEPSS 0.3%CVE-2022-41961MEDIUMBigBlueButton subject to Ineffective user bansEPSS 0.3%CVE-2026-15768MEDIUMInsufficient policy enforcement in HTML-in-Canvas in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin pEPSS 0.3%CVE-2020-26234MEDIUMDisabled Hostname Verification in OpenCastEPSS 0.3%CVE-2026-15775MEDIUMInappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a craEPSS 0.3%CVE-2023-49803HIGH@koa/cors has overly permissive origin policyEPSS 0.3%CVE-2026-55660HIGHTinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeoverEPSS 0.3%CVE-2024-7819HIGHCORS Misconfiguration in danswer-ai/danswerEPSS 0.3%CVE-2024-51037MEDIUMAn issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature in the password resEPSS 0.3%CVE-2026-56181HIGHWindows Network Address Translation (NAT) Spoofing VulnerabilityEPSS 0.3%CVE-2026-75156CRITICALApache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypassEPSS 0.3%CVE-2026-10937HIGHInappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy viaEPSS 0.3%