Fallos del tipo CWE-287

2853 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2026-14300HIGHminiOrange Social Login and Register < 7.8.0 - Unauthenticated Account TakeoverEPSS 0.4%CVE-2026-97878MEDIUMzhistaredu StarTraining Druid Console index.html anonymous missing authenticationEPSS 0.4%CVE-2026-14836HIGHLogin/Signup Popup < 3.2.5 - Unauthenticated Account Takeover via Password Reset Rate Limit BypassEPSS 0.4%CVE-2026-103539MEDIUMZongXR SuperMarket Instant Buy InstantBuyController.java startBuy missing authenticationEPSS 0.4%CVE-2026-14309HIGHChat On Desk < 1.0.9 - Unauthenticated Account Takeover via Password Reset OTP BypassEPSS 0.4%CVE-2026-101073MEDIUMNetcore NR289-GE CGI Dispatcher boa improper authenticationEPSS 0.4%CVE-2026-19718HIGHBlogVault, MalCare and WP Remote 5.16 - 6.62 - Unauthenticated Site Takeover via Connection Key RecoveryEPSS 0.4%CVE-2026-105307MEDIUMCasdoor API Endpoint authz_filter.go ApiFilter missing authenticationEPSS 0.4%CVE-2026-123816HIGHpyLoad: Authentication bypass in API key validation (check_apikey cache)EPSS 0.4%CVE-2026-102248MEDIUMRebuild Login Endpoint login improper authenticationEPSS 0.4%CVE-2026-58066CRITICALRocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did nEPSS 0.4%CVE-2026-91408CRITICALVulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: End User Self Service). Supported versions thaEPSS 0.4%CVE-2025-46573HIGHpassport-wsfed-saml2 Has SAML Authentication Bypass via Attribute SmugglingEPSS 0.4%CVE-2026-19766CRITICALAuthentication Bypass leads to Administrative control of adjacent network hosts in HPE Networking Fabric ComposerEPSS 0.4%CVE-2022-32935MEDIUMA lock screen issue was addressed with improved state management. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 16.1 and iPadOS 1EPSS 0.4%CVE-2026-61630MEDIUMnginx ignition has TOTP Reuse During Validity WindowEPSS 0.4%CVE-2026-101049HIGHHeym before 0.0.53 Slack Webhook Signature Verification BypassEPSS 0.4%CVE-2026-34917MEDIUMLow‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, whose authentication is normally restrictEPSS 0.4%CVE-2026-101050HIGHHeym before 0.0.53 Authentication Bypass via Telegram WebhookEPSS 0.4%CVE-2023-35154HIGHKnowage-Server vulnerable to account validation bypassEPSS 0.4%