Weaknesses of type CWE-640

247 results

Mecanismo fraco de recuperação de senha

É quando o sistema oferece um fluxo para recuperar senhas perdidas, mas esse fluxo usa verificações insuficientes (perguntas fáceis de responder, tokens previsíveis, links sem expiração) ou permite múltiplas tentativas sem limite. Um atacante consegue contornar a autenticação e assumir a conta sem saber a senha original.

Example

Um site que envia um e-mail com link de reset contendo um ID sequencial (user_id=1001, user_id=1002...), sem expiração, ou que valida a recuperação apenas pedindo a 'data de nascimento' — dados frequentemente públicos em redes sociais.

How to mitigate

Use tokens criptograficamente seguros e aleatórios com expiração curta (15-30 min). Implemente rate limiting rigoroso no fluxo de recuperação, valide o link apenas uma vez e considere autenticação multi-fator (SMS, app authenticator) como segunda camada de confirmação.

CVE-2024-9305HIGHAppPresser – Mobile App Framework <= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTPEPSS 0.7%CVE-2023-3222HIGHVulnerability in the password recovery mechanism of Roundcube Password Recovery PluginEPSS 0.7%CVE-2026-12416CRITICALInvoice Generator <= 1.0.0 - Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' ParameterEPSS 0.7%CVE-2024-47547CRITICALRuijie Reyee OS Weak Password Recovery Mechanism for Forgotten PasswordEPSS 0.7%CVE-2026-15155HIGHEssential Addons for Elementor <= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header InjectionEPSS 0.7%CVE-2026-55207HIGHPimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypassEPSS 0.7%CVE-2023-44399MEDIUMZITADEL's password reset does not respect the "Ignoring unknown usernames" settingEPSS 0.7%CVE-2023-4448MEDIUMOpenRapid RapidCMS run-movepass.php password recoveryEPSS 0.7%CVE-2025-10127HIGHDaikin Europe N.V Security Gateway Weak Password Recovery Mechanism for Forgotten PasswordEPSS 0.7%CVE-2026-84699CRITICALTeam Password Manager before 14.184.308 Authentication Bypass in Password ResetEPSS 0.6%CVE-2022-47697CRITICALCOMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 and before is vulnerable to Account takeovEPSS 0.6%CVE-2023-7264HIGHBuild App Online <= 1.0.22 - Account Takeover via Weak Password Reset MechanismEPSS 0.6%CVE-2023-35717HIGHTP-Link Tapo C210 Password Recovery Authentication Bypass VulnerabilityEPSS 0.6%CVE-2026-11551CRITICALBranda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account TakeoverEPSS 0.6%CVE-2015-10071LOWgitter-badger ezpublish-modern-legacy forgotpassword.php password recoveryEPSS 0.6%CVE-2024-9302HIGHApp Builder – Create Native Android & iOS Apps On The Flight <= 5.3.7 - Privilege Escalation and Account Takeover via Weak OTPEPSS 0.6%CVE-2024-0186LOWHuiRan Host Reseller System HTTP POST Request password recoveryEPSS 0.6%CVE-2023-43650HIGHNon-MFA account takeover via brute-force attack on weak password reset code in jumpserverEPSS 0.6%CVE-2021-27654HIGHForgotten password reset functionality for local accounts can be used to bypass local authentication checks.EPSS 0.6%CVE-2026-15689CRITICALDancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_sendEPSS 0.6%