Fallos del tipo CWE-287

2853 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2026-44707MEDIUMChatwoot: Pre-Account Takeover via OAuth on Unconfirmed AccountsEPSS 0.3%CVE-2025-11192HIGHFabric Engine (VOSS) AutoSense Authentication BypassEPSS 0.3%CVE-2025-65127MEDIUMA lack of session validation in the web API component of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote unauthenticated atEPSS 0.3%CVE-2026-14568MEDIUMWP User Frontend < 4.3.8 - Unauthenticated Author-less Attachment DeletionEPSS 0.3%CVE-2026-120263CRITICALGitea OAuth2 account auto-linking takeover through the sign-up formEPSS 0.3%CVE-2026-118129MEDIUMjeremyckahn Chitchatter PostMessage Bootstrap.tsx isConfigMessageEvent improper authenticationEPSS 0.3%CVE-2024-58363MEDIUMSurrealDB before 1.5.4 Authentication Bypass via Database SwitchEPSS 0.3%CVE-2026-105672HIGHUnauthenticated JSON API Authorization Bypass Vulnerability in TP-Link Tapo C325WBEPSS 0.3%CVE-2024-5798LOWVault Incorrectly Validated JSON Web Tokens (JWT) Audience ClaimsEPSS 0.3%CVE-2026-92439HIGHThe SAML plugin in Kong Gateway Enterprise does not enforce AudienceRestriction, allowing a valid assertion issued for another Service ProviEPSS 0.3%CVE-2022-4001HIGHAn authentication bypass vulnerability could allow an attacker to access API functions without authentication.EPSS 0.3%CVE-2026-89080HIGHReally Simple Security < 9.8.1 - Unauthenticated 2FA Bypass via Email Provider State DemotionEPSS 0.3%CVE-2025-65781HIGHAn issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Attachment upload API treats the AEPSS 0.3%CVE-2026-46389CRITICALUDS Identity Config has a client authentication bypass in `ClientIdAndKubernetesSecretAuthenticator`EPSS 0.3%CVE-2026-108108HIGHPHPNuxBill through 2025.3.20 CHAP Authentication Bypass via Password::chap_verify()EPSS 0.3%CVE-2026-84737CRITICALFreeton WP <= 1.0.0 - Unauthenticated Account Takeover via 'secod' ParameterEPSS 0.3%CVE-2026-63238MEDIUMAuthentication bypass vulnerabilityEPSS 0.3%CVE-2024-0130HIGHNVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI contain a vulnerability where an attacker can cause an improper authentication issue bEPSS 0.3%CVE-2026-110955CRITICALWurdey <= 1.0.0 - Unauthenticated Administrator Authentication BypassEPSS 0.3%CVE-2026-84734CRITICALMindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' ParameterEPSS 0.3%