Weaknesses of type CWE-346

696 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2026-96238MEDIUM.NET Security Feature Bypass VulnerabilityEPSS 0.3%CVE-2026-6276HIGHstale custom cookie host causes cookie leakEPSS 0.3%CVE-2025-71217HIGHAn origin validation error vulnerability in the Trend Micro Apex One (mac) agent self-protection mechanism could allow a local attacker to eEPSS 0.3%CVE-2024-8487HIGHCORS Vulnerability in modelscope/agentscopeEPSS 0.3%CVE-2024-41475CRITICALGnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration.EPSS 0.3%CVE-2026-45674HIGHNetty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME RecordsEPSS 0.3%CVE-2024-5549HIGHData leak through CORS misconfiguration in stitionai/devikaEPSS 0.3%CVE-2026-16375CRITICALSite isolation issue in the Networking: HTTP componentEPSS 0.3%CVE-2025-10201HIGHInappropriate implementation in Mojo in Google Chrome on Android, Linux, ChromeOS prior to 140.0.7339.127 allowed a remote attacker to bypasEPSS 0.3%CVE-2024-45352HIGHXiaomi smarthome application Webview has code execution vulnerabilityEPSS 0.3%CVE-2026-16387CRITICALSite isolation issue in the Networking componentEPSS 0.3%CVE-2023-37210—A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confusion and possible spoEPSS 0.3%CVE-2025-4542LOWFreeebird Hotel 酒店管理系统 API SessionInterceptor.java cross-domain policyEPSS 0.3%CVE-2024-7819HIGHCORS Misconfiguration in danswer-ai/danswerEPSS 0.3%CVE-2026-46409CRITICALOpenYak local API: unauthenticated CSRF chain leads to Remote Code ExecutionEPSS 0.3%CVE-2026-32634HIGHGlances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed ServersEPSS 0.3%CVE-2026-55660HIGHTinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeoverEPSS 0.3%CVE-2020-26234MEDIUMDisabled Hostname Verification in OpenCastEPSS 0.3%CVE-2023-49803HIGH@koa/cors has overly permissive origin policyEPSS 0.3%CVE-2026-81315HIGHMCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto headerEPSS 0.3%