Fallos del tipo CWE-287

2853 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2026-41145HIGHMinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer UploadsEPSS 0.3%CVE-2026-121531MEDIUMUmami 2FA Policy route.ts single-factor authenticationEPSS 0.3%CVE-2026-83409HIGHVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that EPSS 0.3%CVE-2024-49755LOWDuende IdentityServer has insufficient validation of DPoP cnf claim in Local APIsEPSS 0.3%CVE-2025-14908MEDIUMJeecgBoot Multi-Tenant Management SysTenantController.java improper authenticationEPSS 0.3%CVE-2026-28428MEDIUMTalishar: Authentication Bypass via Empty authKey Parameter Allows Unauthenticated Game ActionsEPSS 0.3%CVE-2025-69273HIGHSpectrum broken authenticationEPSS 0.3%CVE-2025-64423HIGHCoolify has a Privilege Escalation - low privileged users can see and use admin invitation linksEPSS 0.3%CVE-2023-0863HIGHAuthentication to access the AC wallbox via its Bluetooth Low Energy (BLE) channel can be bypassed, EPSS 0.3%CVE-2026-72917MEDIUMAnythingLLM: Password recovery accepts one recovery code twice after whitespace normalizationEPSS 0.3%CVE-2023-0228HIGHImproper authentication vulnerability in S+ OperationsEPSS 0.3%CVE-2026-73840MEDIUMOpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)EPSS 0.3%CVE-2026-77244CRITICAL[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty tokenEPSS 0.3%CVE-2026-109506MEDIUMImproper Authentication in Multiple TP-Link WiFi RepeatersEPSS 0.3%CVE-2022-45456LOWDenial of service due to unauthenticated API endpoint. The following products are affected: Acronis Agent (Windows, macOS, Linux) before buiEPSS 0.3%CVE-2025-26438HIGHIn smp_process_secure_connection_oob_data of smp_act.cc, there is a possible way to bypass SMP authentication due to Incorrect implementatioEPSS 0.3%CVE-2024-23792MEDIUMInsufficient access controlEPSS 0.3%CVE-2026-118194MEDIUMPage and Post Restriction <= 1.6.1 - Unauthenticated Authentication Bypass via REST API Nonce Bypass via Cookie Re-AuthenticationEPSS 0.3%CVE-2025-11192HIGHFabric Engine (VOSS) AutoSense Authentication BypassEPSS 0.3%CVE-2026-109236MEDIUMCustomer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' ParameterEPSS 0.3%