Weaknesses of type CWE-602

174 results

Confiança inadequada em mecanismo de proteção implementado no cliente

O servidor delega para o cliente (navegador, app, dispositivo) a responsabilidade de implementar uma proteção que deveria ser garantida no servidor. Isso é perigoso porque o cliente está sob controle do atacante — qualquer validação, restrição ou lógica de segurança implementada apenas no lado do cliente pode ser contornada, alterada ou removida. O servidor fica vulnerável quando assume que o cliente vai cumprir as regras.

Example

Um e-commerce que valida limite de quantidade de compra apenas no JavaScript do frontend, ou um banco que confere crédito disponível apenas no navegador antes de enviar a transação. Um atacante modifica o código do cliente, remove a validação ou faz requisições diretas ao servidor, contornando a proteção completamente.

How to mitigate

Implemente toda validação, autenticação e autorização críticas no servidor. Nunca confie em mecanismos de segurança executados apenas no cliente. Use validação no cliente para UX, mas sempre revalide e reforce as regras no backend antes de qualquer operação sensível.

CVE-2026-17974MEDIUMInsufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed a local attacker to bypass navigation restrictioEPSS 0.2%CVE-2026-3941MEDIUMInsufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictiEPSS 0.2%CVE-2026-56693MEDIUMNanoClaw < 2.1.17 - Privilege Escalation via Unauthorized create_agent System ActionEPSS 0.2%CVE-2026-65938MEDIUMWhatsUp Gold versions prior to 26.0.2 contain an improper authorization vulnerability in the Scheduled Reports API.EPSS 0.2%CVE-2026-11184MEDIUMInsufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictionsEPSS 0.2%CVE-2024-6831MEDIUMSeth Fogie, member of AXIS Camera Station Pro Bug Bounty Program has found that it is possible to edit and/or remove views without the necesEPSS 0.2%CVE-2025-6249HIGHAn authentication bypass vulnerability was reported in FileZ client application that could allow a local attacker with elevated permissions EPSS 0.2%CVE-2026-5901MEDIUMInsufficient policy enforcement in DevTools in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a maEPSS 0.1%CVE-2026-11267MEDIUMInsufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a EPSS 0.1%CVE-2026-11062MEDIUMInsufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a EPSS 0.1%CVE-2025-41402MEDIUMClient-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competeEPSS 0.1%CVE-2024-41751MEDIUMIBM SmartCloud Analytics - Log Analysis security bypassEPSS 0.1%CVE-2024-41750MEDIUMIBM SmartCloud Analytics - Log Analysis security bypassEPSS 0.1%CVE-2025-46591MEDIUMOut-of-bounds data read vulnerability in the authorization module Impact: Successful exploitation of this vulnerability may affect service cEPSS 0.1%