Fallos del tipo CWE-287

2854 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2026-1410MEDIUMBeetel 777VR1 UART missing authenticationEPSS 0.3%CVE-2026-56836HIGHPraisonAI recipe serve Typer command bypasses the non-localhost authentication guardEPSS 0.3%CVE-2026-44460HIGHFileRise: TOTP Bypass via Setup Endpoint Disclosing Existing SecretEPSS 0.3%CVE-2020-7323MEDIUMAuthentication Protection Bypass vulnerability in ENS for WindowsEPSS 0.3%CVE-2024-7487MEDIUMImproper Authentication in WSO2 Identity Server 7.0.0 Allows Bypass of App-Native AuthenticationEPSS 0.3%CVE-2026-49272HIGHOAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflowEPSS 0.3%CVE-2026-105949HIGHCruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpointsEPSS 0.3%CVE-2025-54761HIGHAn issue was discovered in PPress 0.0.9 allowing attackers to gain escilated privlidges via crafted session cookie.EPSS 0.3%CVE-2018-17923—SAGA1-L8B with any firmware versions prior to A0.10 are vulnerable to an attack that an attacker with physical access to the product may ablEPSS 0.3%CVE-2024-45042MEDIUMOry Kratos's `highest_available` setting does not properly respect code + mfa credentialsEPSS 0.3%CVE-2025-31228MEDIUMThe issue was addressed with improved authentication. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. An attacker with physiEPSS 0.3%CVE-2026-83426HIGHVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that EPSS 0.3%CVE-2026-89093MEDIUMBetter Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/registerEPSS 0.3%CVE-2026-52793HIGHFroxlor: API Authentication bypasses 2FA AuthenticationEPSS 0.3%CVE-2025-10463HIGHImproper Authentication in Birtech Information Technologies' SensawayEPSS 0.3%CVE-2024-55886MEDIUMOpenTelemetry Logs source may lack authentication with some custom pluginsEPSS 0.3%CVE-2026-108865HIGHAmoyLab Unla through 0.10.0 OAuth2 Authentication Bypass via /authorizeEPSS 0.3%CVE-2025-52571CRITICALHikka vulnerable to RCE through edits in a channelEPSS 0.3%CVE-2026-77771HIGHminiOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP LockoutEPSS 0.3%CVE-2025-22232MEDIUMSpring Cloud Config Server May Not Use Vault Token Sent By ClientsEPSS 0.3%