Weaknesses of type CWE-602

186 results

Confiança inadequada em mecanismo de proteção implementado no cliente

O servidor delega para o cliente (navegador, app, dispositivo) a responsabilidade de implementar uma proteção que deveria ser garantida no servidor. Isso é perigoso porque o cliente está sob controle do atacante — qualquer validação, restrição ou lógica de segurança implementada apenas no lado do cliente pode ser contornada, alterada ou removida. O servidor fica vulnerável quando assume que o cliente vai cumprir as regras.

Example

Um e-commerce que valida limite de quantidade de compra apenas no JavaScript do frontend, ou um banco que confere crédito disponível apenas no navegador antes de enviar a transação. Um atacante modifica o código do cliente, remove a validação ou faz requisições diretas ao servidor, contornando a proteção completamente.

How to mitigate

Implemente toda validação, autenticação e autorização críticas no servidor. Nunca confie em mecanismos de segurança executados apenas no cliente. Use validação no cliente para UX, mas sempre revalide e reforce as regras no backend antes de qualquer operação sensível.

CVE-2026-14109CRITICALInsufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer pEPSS 0.3%CVE-2024-32512MEDIUMWordPress weForms plugin <= 1.6.20 - Form Submission Restriction Bypass vulnerabilityEPSS 0.3%CVE-2024-52960MEDIUMA client-side enforcement of server-side security vulnerability [CWE-602] in Fortinet FortiSandbox version 5.0.0, 4.4.0 through 4.4.6 and beEPSS 0.3%CVE-2026-16480MEDIUMIBM® Db2® is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data.EPSS 0.3%CVE-2024-49824MEDIUMIBM Robotic Process Automation security bypassEPSS 0.3%CVE-2022-31233MEDIUMUnisphere for PowerMax versions before 9.2.3.15 contain a privilege escalation vulnerability. An adjacent malicious user may potentially expEPSS 0.3%CVE-2026-30521MEDIUMA Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation. The application EPSS 0.3%CVE-2024-42340HIGHCyberArk - CWE-602: Client-Side Enforcement of Server-Side SecurityEPSS 0.3%CVE-2024-43188MEDIUMIBM Business Automation Workflow improper input validationEPSS 0.3%CVE-2026-77793MEDIUMRegistrationMagic < 6.0.9.9 - Unauthenticated Payment Bypass via Omitted Price FieldEPSS 0.3%CVE-2026-14831MEDIUMEasy Booking < 3.5.0 - Unauthenticated Minimum Booking Duration BypassEPSS 0.3%CVE-2026-42160CRITICALData Space Portal: Incorrect Authorization and Client-Side Enforcement of Server-Side Security in ghcr.io/sovity/ds-portal-ce-backendEPSS 0.3%CVE-2025-47697MEDIUMClient-side enforcement of server-side security issue exists in wivia 5 all versions. If exploited, an unauthenticated attacker may bypass aEPSS 0.3%CVE-2026-11011HIGHInsufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised thEPSS 0.3%CVE-2025-36039MEDIUMIBM Aspera Faspex bypass securityEPSS 0.3%CVE-2026-25737HIGHBudibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS)EPSS 0.3%CVE-2026-54047CRITICALLaci Synchroni Backend Vulnerable to Account Takeover / User Impersonation via Client-Side Configuration ManipulationEPSS 0.3%CVE-2025-32359MEDIUMIn Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configEPSS 0.3%CVE-2026-116605MEDIUMSourceCodester Online Food Ordering System order.php client-side enforcement of server-side securityEPSS 0.3%CVE-2026-17703MEDIUMInsufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigatEPSS 0.3%