Fallos del tipo CWE-1390

118 resultados

Autenticação fraca

A aplicação implementa mecanismos de autenticação insuficientes ou contornáveis, permitindo que um atacante se passe por outro usuário sem credenciais válidas ou com credenciais triviais. Isso ocorre quando o sistema não valida adequadamente a identidade do usuário ou aceita métodos de autenticação inadequados (senhas fracas, sem MFA, tokens previsíveis, etc.).

Ejemplo

Uma API que verifica login apenas checando se um parâmetro 'admin=true' está presente na requisição, ou uma aplicação que aceita qualquer senha com um dígito como válida, permitindo que invasores acessem contas sem credenciais verdadeiras.

Cómo mitigar

Implemente autenticação forte: enforce senhas complexas, use frameworks estabelecidos (OAuth 2.0, SAML), ative multi-factor authentication (MFA), valide credenciais no servidor (nunca no cliente) e use protocolos criptografados. Revise regularmente os mecanismos de autenticação em testes de segurança.

CVE-2022-45860MEDIUMA weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versEPSS 0.5%CVE-2026-110475CRITICALImproper Authentication Vulnerability in CreditNirvana Collections PlatformEPSS 0.5%CVE-2026-85323MEDIUMNetwork Device Enrollment Service (NDES) Spoofing VulnerabilityEPSS 0.5%CVE-2024-48886HIGHA weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, ForEPSS 0.5%CVE-2026-28710HIGHSensitive information disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber ProtectEPSS 0.5%CVE-2026-6274CRITICALAuthentication Bypass in DTS Electronics' Redline WR3200EPSS 0.5%CVE-2025-5484HIGHSinoTrack GPS Receiver Weak AuthenticationEPSS 0.5%CVE-2026-6886CRITICALBorG Technology Corporation｜Borg SPM 2007 - Authentication BypassEPSS 0.5%CVE-2026-92288CRITICALLemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying PartyEPSS 0.4%CVE-2024-39848CRITICALInternet2 Grouper before 5.6 allows authentication bypass when LDAP authentication is used in certain ways. This is related to internet2.midEPSS 0.4%CVE-2026-83840HIGHWindows Error Reporting Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-59554HIGHWordPress Ziina plugin <= 1.2.21 - Broken Authentication vulnerabilityEPSS 0.4%CVE-2025-29994HIGHImproper Authentication Vulnerability in CAP back office applicationEPSS 0.4%CVE-2025-21552MEDIUMVulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). SupporteEPSS 0.4%CVE-2024-47397HIGHWeak authentication issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE firmware versions 2.0.10 and earlier. If this vEPSS 0.4%CVE-2026-0204HIGHA vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific EPSS 0.4%CVE-2025-47479MEDIUMWordPress WP Compress plugin <= 6.30.30 - Broken Authentication VulnerabilityEPSS 0.4%CVE-2024-29038MEDIUMtpm2 does not detect if quote was not generated by TPMEPSS 0.4%CVE-2025-30468MEDIUMThis issue was addressed through improved state management. This issue is fixed in iOS 26 and iPadOS 26. Private Browsing tabs may be accessEPSS 0.4%CVE-2026-85939MEDIUMWindows Kernel Security Feature Bypass VulnerabilityEPSS 0.4%