Weaknesses of type CWE-602

185 results

Confiança inadequada em mecanismo de proteção implementado no cliente

O servidor delega para o cliente (navegador, app, dispositivo) a responsabilidade de implementar uma proteção que deveria ser garantida no servidor. Isso é perigoso porque o cliente está sob controle do atacante — qualquer validação, restrição ou lógica de segurança implementada apenas no lado do cliente pode ser contornada, alterada ou removida. O servidor fica vulnerável quando assume que o cliente vai cumprir as regras.

Example

Um e-commerce que valida limite de quantidade de compra apenas no JavaScript do frontend, ou um banco que confere crédito disponível apenas no navegador antes de enviar a transação. Um atacante modifica o código do cliente, remove a validação ou faz requisições diretas ao servidor, contornando a proteção completamente.

How to mitigate

Implemente toda validação, autenticação e autorização críticas no servidor. Nunca confie em mecanismos de segurança executados apenas no cliente. Use validação no cliente para UX, mas sempre revalide e reforce as regras no backend antes de qualquer operação sensível.

CVE-2026-30783MEDIUMRustDesk Client Can Orphan API Channel to Ignore All Admin Commands and ACL PoliciesEPSS 0.4%CVE-2026-77999HIGHJoomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6EPSS 0.4%CVE-2026-82189HIGHJoomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7EPSS 0.4%CVE-2026-59504CRITICALPriority – CWE-602: Client-Side Enforcement of Server-Side SecurityEPSS 0.4%CVE-2026-73627MEDIUMJupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement BypassEPSS 0.4%CVE-2025-43699MEDIUMClient-Side Enforcement of Server-Side Security vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of required permission checEPSS 0.4%CVE-2025-1838MEDIUMIBM Cloud Pak for Business Automation denial of serviceEPSS 0.4%CVE-2025-20113HIGHCisco Unified Intelligence Center Privilege Escalation VulnerabilityEPSS 0.4%CVE-2026-57912HIGHJohnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by recruited students, and notes entered about studentEPSS 0.4%CVE-2026-57913HIGHJohnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allows viewing of meeting minutes and transcripts.EPSS 0.4%CVE-2026-14086HIGHInsufficient policy enforcement in HID in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a craEPSS 0.4%CVE-2025-32808HIGHW. W. Norton InQuizitive through 2025-04-08 allows students to insert arbitrary records of their quiz performance into the backend, because EPSS 0.4%CVE-2025-56694MEDIUMClient-side password validation (CWE-602) in lumasoft fotoShare Cloud 2025-03-13 allowing unauthenticated attackers to view password-protectEPSS 0.4%CVE-2023-20172MEDIUMCisco Identity Services Engine Arbitrary File Delete and File Read VulnerabilitiesEPSS 0.4%CVE-2025-53969HIGHCognex In-Sight Explorer and In-Sight Camera Firmware Client-Side Enforcement of Server-Side SecurityEPSS 0.4%CVE-2024-32685MEDIUMWordPress WP Ultimate Review plugin <= 2.2.5 - Review Score Manipulation vulnerabilityEPSS 0.4%CVE-2026-100306MEDIUMTDuck survey form through 6.0 Write Password Bypass via Client-Side EnforcementEPSS 0.4%CVE-2026-110314MEDIUMWebSocket frames keep reaching the WebSock after a server-initiated close in BanditEPSS 0.4%CVE-2026-46485HIGHDash: Users can write to config despire permissions (OIDC tested)EPSS 0.4%CVE-2023-20171MEDIUMCisco Identity Services Engine Arbitrary File Delete and File Read VulnerabilitiesEPSS 0.4%