Weaknesses of type CWE-640

247 results

Mecanismo fraco de recuperação de senha

É quando o sistema oferece um fluxo para recuperar senhas perdidas, mas esse fluxo usa verificações insuficientes (perguntas fáceis de responder, tokens previsíveis, links sem expiração) ou permite múltiplas tentativas sem limite. Um atacante consegue contornar a autenticação e assumir a conta sem saber a senha original.

Example

Um site que envia um e-mail com link de reset contendo um ID sequencial (user_id=1001, user_id=1002...), sem expiração, ou que valida a recuperação apenas pedindo a 'data de nascimento' — dados frequentemente públicos em redes sociais.

How to mitigate

Use tokens criptograficamente seguros e aleatórios com expiração curta (15-30 min). Implemente rate limiting rigoroso no fluxo de recuperação, valide o link apenas uma vez e considere autenticação multi-fator (SMS, app authenticator) como segunda camada de confirmação.

CVE-2025-14783MEDIUMEasy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirectEPSS 0.3%CVE-2026-112035MEDIUMaircheng-org iWebShop-5 simple.php send_message_mobile password recoveryEPSS 0.3%CVE-2025-32486CRITICALWordPress Material Dashboard plugin <= 1.4.6 - Privilege Escalation VulnerabilityEPSS 0.3%CVE-2026-53904MEDIUMAccount Denial of Service in MCOEPSS 0.3%CVE-2025-53373HIGHNatours has a 1 Click Account take over on reset password via Host Header injectionEPSS 0.3%CVE-2025-7881MEDIUMMercusys MW301R Web Interface password recoveryEPSS 0.3%CVE-2026-46346MEDIUMGoobi viewer: Predictable Password Reset Token Allows Unauthorized Password ResetEPSS 0.3%CVE-2026-63159CRITICALOmnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account TakeoverEPSS 0.3%CVE-2024-45670MEDIUMIBM Security SOAR weak password recovery mechanismEPSS 0.3%CVE-2025-14696MEDIUMShenzhen Sixun Software Sixun Shanghui Group Business Management System UpdatePasswordBatch password recoveryEPSS 0.3%CVE-2024-36407LOWSuiteCRM unauthenticated user password reset on php7EPSS 0.3%CVE-2026-94380HIGHHost Header Injection in HAVELSAN's Liman MYSEPSS 0.3%CVE-2026-108737HIGHTraccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose ConfusionEPSS 0.3%CVE-2026-32865CRITICALOPEXUS eComplaint and eCase insecure password resetEPSS 0.3%CVE-2025-53704HIGHMAXHUB Pivot Weak Password Recovery Mechanism for Forgotten PasswordEPSS 0.3%CVE-2026-61143MEDIUMVulnerability in the Oracle Communications Convergent Charging Controller product of Oracle Communications (component: Prov IF). Supported EPSS 0.3%CVE-2026-53646HIGHFOSSBilling: Client password reset token reuse allows persistent account takeoverEPSS 0.3%CVE-2023-29145—The Malwarebytes EDR 1.0.11 for Linux driver doesn't properly ensure whitelisting of executable libraries loaded by executable files, allowiEPSS 0.3%CVE-2026-100870HIGHSylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host HeaderEPSS 0.3%CVE-2026-34751CRITICALPayload has Unvalidated Input in Password Recovery EndpointsEPSS 0.3%