Fallos del tipo CWE-287

2855 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2024-38351MEDIUMPassword auth and OAuth2 unverified email linkingEPSS 0.3%CVE-2025-15069HIGHPrivilege Escalation in Gmission Web FAXEPSS 0.3%CVE-2026-80128MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper AuthentiEPSS 0.3%CVE-2026-8508MEDIUMAn improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 couEPSS 0.3%CVE-2023-5502HIGHOn affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, a malicious supplicant may bypass authentication.EPSS 0.3%CVE-2026-76725CRITICALAuthentication Bypass in a Management Protocol of HPE Networking Instant ON APsEPSS 0.3%CVE-2025-54786MEDIUMSuiteCRM: Legacy iCal service allows unauthenticated access to meeting dataEPSS 0.3%CVE-2026-65211HIGHSupermicro BMC IPMI feature contains Critical Privilege Escalation and Arbitrary Access vulnerabilityEPSS 0.3%CVE-2025-21450CRITICALImproper Authentication in GPS_GNSSEPSS 0.3%CVE-2026-4476MEDIUMYi Technology YI Home Camera CGI Endpoint ipc missing authenticationEPSS 0.3%CVE-2022-43978MEDIUMLimited Authentication bypass due to hardcoded secretEPSS 0.3%CVE-2026-107180HIGHMISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required InstancesEPSS 0.3%CVE-2026-97847HIGHKeycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authorityEPSS 0.3%CVE-2025-7703LOWAuthentication vulnerability in the mobile application（tech.palm.id）may lead to the risk of information leakage.EPSS 0.3%CVE-2022-42463HIGHSoftbus_server in communication subsystem has a authenication bypass vulnerability in a callback handler function. Attackers can launch attacks on distributed networks by sending Bluetooth rfcomm packets to any remote device and executing arbitrary co ...EPSS 0.3%CVE-2026-28787HIGHOneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replayEPSS 0.3%CVE-2025-55340HIGHWindows Remote Desktop Protocol Security Feature BypassEPSS 0.3%CVE-2026-33042MEDIUMParse Server affected by empty authData bypassing credential requirement on signupEPSS 0.3%CVE-2026-85962HIGHImproper authentication in Progress MarkLogic Server SAML processingEPSS 0.3%CVE-2026-7876CRITICALAuthentication bypass vulnerability found in Aspera High-Speed Transfer Server for Cloud Pak for IntegrationEPSS 0.3%