Fallos del tipo CWE-1391

66 resultados

Uso de credenciais fracas

Ocorre quando uma aplicação aceita, permite ou armazena credenciais (senhas, tokens, chaves) que não possuem força criptográfica ou complexidade suficiente. Isso facilita ataques de força bruta, dicionário ou até adivinhação, comprometendo a autenticação do sistema.

Ejemplo

Uma API que permite login com senhas de 3 caracteres, ou um serviço que gera tokens de acesso com apenas 4 dígitos numéricos. Um atacante consegue testar todas as combinações possíveis em segundos e ganhar acesso não autorizado.

Cómo mitigar

Implemente políticas obrigatórias de senha (mínimo 12 caracteres, complexidade, sem padrões óbvios) e use algoritmos criptográficos fortes para gerar tokens (ex: pelo menos 256 bits de entropia). Valide a força das credenciais tanto no servidor quanto na interface de criação.

CVE-2026-8076CRITICALWeak credentials vulnerability in the CashDro 3 web administration panelEPSS 0.3%CVE-2026-114616HIGHAuthlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)EPSS 0.3%CVE-2025-1081LOWBharti Airtel Xstream Fiber WiFi Password weak credentialsEPSS 0.3%CVE-2025-55584MEDIUMTOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain insecure credentials for the telnet service and root account.EPSS 0.3%CVE-2025-6737HIGHSecurden Unified PAM Shared SSH Key and Cloud InfrastructureEPSS 0.3%CVE-2023-28368MEDIUMTP-Link L2 switch T2600G-28SQ firmware versions prior to 'T2600G-28SQ(UN)_V1_1.0.6 Build 20230227' uses vulnerable SSH host keys. A fake devEPSS 0.3%CVE-2026-44351CRITICALfast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypassEPSS 0.3%CVE-2026-47325MEDIUMWeak password policy in ProjectsAndPrograms school-management-systemEPSS 0.2%CVE-2026-22094CRITICALWeak root password in EVbee DC 80EPSS 0.2%CVE-2025-22936MEDIUMAn issue in Smartcom Bulgaria AD Smartcom Ralink CPE/WiFi router SAM-4G1G-TT-W-VC, SAM-4F1F-TT-W-A1 allows a remote attacker to obtain sensiEPSS 0.2%CVE-2026-57473MEDIUMA vulnerability exists in the netclient and factory services of Reolink Home Hub (versions prior to v3.3.0.456_26031911) due to the possibilEPSS 0.2%CVE-2024-52331HIGHECOVACS lawnmowers and vacuums deterministic firmware encryption keyEPSS 0.2%CVE-2026-24449MEDIUMFor WRC-X1500GS-B and WRC-X1500GSA-B, the initial passwords can be calculated easily from the system information.EPSS 0.2%CVE-2026-66408MEDIUMThe root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may alloEPSS 0.2%CVE-2024-5634HIGHLongse model LBH30FE200W cameras, as well as products based on this device, make use of telnet passwords which follow a specific pattern. OnEPSS 0.2%CVE-2026-107153HIGHMultiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physiEPSS 0.2%CVE-2025-4057MEDIUMActivemq-artemis-operator: amq broker operator starting credentials reuseEPSS 0.2%CVE-2023-3470MEDIUMBIG-IP FIPS HSM password vulnerability CVE-2023-3470EPSS 0.2%CVE-2026-49852HIGHjoserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)EPSS 0.2%CVE-2026-88761MEDIUMBotslab G980H Dashcams Use of Weak CredentialsEPSS 0.2%