Fallos del tipo CWE-1390

118 resultados

Autenticação fraca

A aplicação implementa mecanismos de autenticação insuficientes ou contornáveis, permitindo que um atacante se passe por outro usuário sem credenciais válidas ou com credenciais triviais. Isso ocorre quando o sistema não valida adequadamente a identidade do usuário ou aceita métodos de autenticação inadequados (senhas fracas, sem MFA, tokens previsíveis, etc.).

Ejemplo

Uma API que verifica login apenas checando se um parâmetro 'admin=true' está presente na requisição, ou uma aplicação que aceita qualquer senha com um dígito como válida, permitindo que invasores acessem contas sem credenciais verdadeiras.

Cómo mitigar

Implemente autenticação forte: enforce senhas complexas, use frameworks estabelecidos (OAuth 2.0, SAML), ative multi-factor authentication (MFA), valide credenciais no servidor (nunca no cliente) e use protocolos criptografados. Revise regularmente os mecanismos de autenticação em testes de segurança.

CVE-2025-59249HIGHMicrosoft Exchange Server Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2026-62895HIGHAzure Arc SQL Server Extension Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2025-47995MEDIUMAzure Machine Learning Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2026-77483HIGHSQL Server Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2025-30411CRITICALSensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (LiEPSS 0.8%CVE-2024-54092CRITICALA vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (AlEPSS 0.8%CVE-2024-34451CRITICALGhost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headeEPSS 0.8%CVE-2025-23058HIGHAuthenticated Broken Access Control Vulnerability in ClearPass Policy Manager Web-Based Management InterfaceEPSS 0.7%CVE-2026-83674HIGHActive Directory Federation Services (AD FS) Spoofing VulnerabilityEPSS 0.7%CVE-2025-7326HIGHEOL ASP.NET Core Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2024-0822HIGHOvirt: authentication bypassEPSS 0.7%CVE-2023-41862MEDIUMWordPress VS Contact Form plugin <= 14.0 - Sum Captcha Bypass vulnerabilityEPSS 0.7%CVE-2025-30412CRITICALSensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (LiEPSS 0.7%CVE-2025-12870CRITICALaEnrich｜eHRD - Authentication AbuseEPSS 0.7%CVE-2026-83511HIGHActive Directory Federation Services (AD FS) Spoofing VulnerabilityEPSS 0.7%CVE-2026-69982MEDIUMActive Directory Federation Services (AD FS) Security Feature Bypass VulnerabilityEPSS 0.6%CVE-2025-1727HIGHEnd-of-Train and Head-of-Train Remote Linking Protocol Weak AuthenticationEPSS 0.6%CVE-2026-70005MEDIUMActive Directory Federation Services (AD FS) Security Feature Bypass VulnerabilityEPSS 0.6%CVE-2026-69802HIGHNetwork Device Enrollment Service (NDES) Remote Code Execution VulnerabilityEPSS 0.6%CVE-2023-53894CRITICALphpfm 1.7.9 Authentication Bypass via Type Juggling VulnerabilityEPSS 0.6%