Fallos del tipo CWE-287

2854 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2026-63238MEDIUMAuthentication bypass vulnerabilityEPSS 0.3%CVE-2026-84737CRITICALFreeton WP <= 1.0.0 - Unauthenticated Account Takeover via 'secod' ParameterEPSS 0.3%CVE-2026-93907HIGHIBM WebSphere Application Server is affected by a bypass authentication vulnerabilityEPSS 0.3%CVE-2026-33665HIGHn8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account TakeoverEPSS 0.3%CVE-2018-0362—A vulnerability in BIOS authentication management of Cisco 5000 Series Enterprise Network Compute System and Cisco Unified Computing (UCS) EEPSS 0.3%CVE-2024-56335HIGHPrivilege escalation allows organization groups to be updated/deleted if their UUID is known in vaultwardenEPSS 0.3%CVE-2026-100876MEDIUMmathurvishal CloudClassroom-PHP-Project loginlinkstudent.php missing authenticationEPSS 0.3%CVE-2026-53561HIGHApache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive userEPSS 0.3%CVE-2026-84296MEDIUMSSH Multi-Factor Authentication Bypass in Progress WS_FTP ServerEPSS 0.3%CVE-2026-26141HIGHHybrid Worker Extension (Arc‑enabled Windows VMs) Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-3627MEDIUMMoodle: partial data exposure in moodle before completing multi-factor authenticationEPSS 0.3%CVE-2026-81237MEDIUMDell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Improper Authentication vulnerability. An unauthenticated attacker wiEPSS 0.3%CVE-2023-3591MEDIUMLack of previous password reset tokens on new token creationEPSS 0.3%CVE-2025-56578MEDIUMAn issue in RTSPtoWeb v.2.4.3 allows a remote attacker to obtain sensitive information and executearbitrary code via the lack of authenticatEPSS 0.3%CVE-2026-71326LOWTraefik: BasicAuth singleflight key collision allows authenticated identity spoofingEPSS 0.3%CVE-2024-3826HIGHBroken SAML ValidationEPSS 0.3%CVE-2026-34531MEDIUMFlask-HTTPAuth invokes token verification callback when missing or empty token was given by clientEPSS 0.3%CVE-2026-115213CRITICALEASY-JS-WPAPI <= 2.0 - Unauthenticated Administrator Password Disclosure and Authentication BypassEPSS 0.3%CVE-2026-40177CRITICALPassword bypass when 2FA is activatedEPSS 0.3%CVE-2025-66515LOWNextcloud Approval app allows users to request approval for other users fileEPSS 0.3%