Weaknesses of type CWE-640

247 results

Mecanismo fraco de recuperação de senha

É quando o sistema oferece um fluxo para recuperar senhas perdidas, mas esse fluxo usa verificações insuficientes (perguntas fáceis de responder, tokens previsíveis, links sem expiração) ou permite múltiplas tentativas sem limite. Um atacante consegue contornar a autenticação e assumir a conta sem saber a senha original.

Example

Um site que envia um e-mail com link de reset contendo um ID sequencial (user_id=1001, user_id=1002...), sem expiração, ou que valida a recuperação apenas pedindo a 'data de nascimento' — dados frequentemente públicos em redes sociais.

How to mitigate

Use tokens criptograficamente seguros e aleatórios com expiração curta (15-30 min). Implemente rate limiting rigoroso no fluxo de recuperação, valide o link apenas uma vez e considere autenticação multi-fator (SMS, app authenticator) como segunda camada de confirmação.

CVE-2021-36436MEDIUMAn issue in Mobicint Backend for Credit Unions v3 allows attackers to retrieve partial email addresses and user entered information via submEPSS 0.5%CVE-2023-42481HIGHImproper Access Control vulnerability in SAP Commerce CloudEPSS 0.5%CVE-2026-27593CRITICALStatamic is vulnerable to account takeover via password reset link injectionEPSS 0.5%CVE-2025-52560HIGHKanboard Password Reset Poisoning via Host Header InjectionEPSS 0.5%CVE-2025-13565MEDIUMSourceCodester Inventory Management System resetPassword.php password recoveryEPSS 0.5%CVE-2024-8692MEDIUMTDuckCloud TDuckPro password recoveryEPSS 0.5%CVE-2026-14364CRITICALTrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid'EPSS 0.5%CVE-2023-5296MEDIUMXinhu RockOA Password password recoveryEPSS 0.5%CVE-2026-9273CRITICALMembership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account TakeoverEPSS 0.5%CVE-2025-4320CRITICALInformation Disclosure in Birebirsoft's SufirmamEPSS 0.5%CVE-2026-90522MEDIUMjaychouchannel Tourism-Management-System Password Recovery UsersController.java resetPass password recoveryEPSS 0.5%CVE-2026-28213CRITICALEverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API ResponseEPSS 0.5%CVE-2026-28681HIGHIRRd: web UI host header injection allows password reset poisoning via attacker-controlled email linksEPSS 0.5%CVE-2026-66691CRITICALWordPress Nokri theme <= 1.6.6 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-61967CRITICALWordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerabilityEPSS 0.5%CVE-2026-18363CRITICALWeak password recovery mechanism in osTicket by Enhancesoft LLCEPSS 0.5%CVE-2026-42606HIGHAzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA BypassEPSS 0.5%CVE-2026-80196HIGHKimai before 2.58.0 Authentication Bypass via Password Reset LinkEPSS 0.5%CVE-2025-10322MEDIUMWavlink WL-WN578W2 sysinit.html password recoveryEPSS 0.5%CVE-2026-72856HIGHBudibase before 3.40.0 Authentication Bypass via Tenant Owner EmailEPSS 0.5%