Weaknesses of type CWE-602

174 results

Confiança inadequada em mecanismo de proteção implementado no cliente

O servidor delega para o cliente (navegador, app, dispositivo) a responsabilidade de implementar uma proteção que deveria ser garantida no servidor. Isso é perigoso porque o cliente está sob controle do atacante — qualquer validação, restrição ou lógica de segurança implementada apenas no lado do cliente pode ser contornada, alterada ou removida. O servidor fica vulnerável quando assume que o cliente vai cumprir as regras.

Example

Um e-commerce que valida limite de quantidade de compra apenas no JavaScript do frontend, ou um banco que confere crédito disponível apenas no navegador antes de enviar a transação. Um atacante modifica o código do cliente, remove a validação ou faz requisições diretas ao servidor, contornando a proteção completamente.

How to mitigate

Implemente toda validação, autenticação e autorização críticas no servidor. Nunca confie em mecanismos de segurança executados apenas no cliente. Use validação no cliente para UX, mas sempre revalide e reforce as regras no backend antes de qualquer operação sensível.

CVE-2026-64813CRITICALIn JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development sessionEPSS 0.5%CVE-2026-65051MEDIUMNinja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission HandlerEPSS 0.5%CVE-2026-72867CRITICALDokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts)EPSS 0.5%CVE-2023-48789MEDIUMA client-side enforcement of server-side security in Fortinet FortiPortal version 6.0.0 through 6.0.14 allows attacker to improper access coEPSS 0.5%CVE-2022-3047MEDIUMInsufficient policy enforcement in Extensions API in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a user to instalEPSS 0.5%CVE-2025-66507HIGH1Panel – CAPTCHA Bypass via Client-Controlled FlagEPSS 0.5%CVE-2026-73267HIGHClusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership checkEPSS 0.5%CVE-2026-23478CRITICALCal.com has an Authentication Bypass via Unvalidated Email in Custom JWT CallbackEPSS 0.5%CVE-2025-6025HIGHOrder Tip for WooCommerce <= 1.5.4 - Unauthenticated Tip Manipulation to Negative Value Leading to Unauthorized DiscountsEPSS 0.5%CVE-2023-0750CRITICALYellowbrik PEC-1864 authentication bypassEPSS 0.4%CVE-2025-42601HIGHCaptcha Bypass Vulnerability in Meon KYC solutionsEPSS 0.4%CVE-2026-46485HIGHDash: Users can write to config despire permissions (OIDC tested)EPSS 0.4%CVE-2025-43699MEDIUMClient-Side Enforcement of Server-Side Security vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of required permission checEPSS 0.4%CVE-2026-57913HIGHJohnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allows viewing of meeting minutes and transcripts.EPSS 0.4%CVE-2026-57912HIGHJohnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by recruited students, and notes entered about studentEPSS 0.4%CVE-2026-56256HIGHCapgo - Two-Factor Authentication Bypass via Organization Management APIEPSS 0.4%CVE-2026-17703MEDIUMInsufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigatEPSS 0.4%CVE-2026-14086HIGHInsufficient policy enforcement in HID in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a craEPSS 0.4%CVE-2025-20113HIGHCisco Unified Intelligence Center Privilege Escalation VulnerabilityEPSS 0.4%CVE-2023-20172MEDIUMCisco Identity Services Engine Arbitrary File Delete and File Read VulnerabilitiesEPSS 0.4%