Fallos del tipo CWE-287

2855 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2024-21635HIGHMemos Access Tokens Stay Valid after User Password ChangeEPSS 0.3%CVE-2026-32246HIGHTinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpointEPSS 0.3%CVE-2026-91493HIGHVulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions thEPSS 0.3%CVE-2025-22477HIGHDell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Authentication vulnerability. An unauthenticated attaEPSS 0.3%CVE-2023-50804LOWAn issue was discovered in Samsung Mobile Processor, and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Exynos 1080, ExEPSS 0.3%CVE-2026-73764HIGHAuthentication Bypass Vulnerabilities Leading to Unauthorized Modification and Service Disruption in AOS-CXEPSS 0.3%CVE-2025-15671MEDIUMWelcart e-Commerce < 2.12.1 - Session Fixation via uscesid ParameterEPSS 0.3%CVE-2026-33746CRITICALConvoy: JWT Signature Verification Bypass Allows Authentication as Arbitrary UsersEPSS 0.3%CVE-2024-35775MEDIUMWordPress Slider by Soliloquy plugin <= 2.7.6 - Broken Access Control to XSS vulnerabilityEPSS 0.3%CVE-2022-41579MEDIUMThere is an insufficient authentication vulnerability in some Huawei band products. Successful exploit could allow the attacker to spoof theEPSS 0.3%CVE-2026-16282MEDIUMAppointment Hour Booking < 1.5.88 - Unauthenticated Booking Price Manipulation via tcost ParameterEPSS 0.3%CVE-2026-14305MEDIUMWP Delicious < 1.10.2 - Unauthenticated Arbitrary Post Meta Update via recipe_likesEPSS 0.3%CVE-2026-14547MEDIUMEstatik Real Estate Plugin < 4.3.3 - Unauthenticated Arbitrary-Recipient Mail Relay via Request FormEPSS 0.3%CVE-2026-103514HIGHWP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP Code ReplayEPSS 0.3%CVE-2026-85350MEDIUMUpsellWP < 2.2.10 - Unauthenticated Price Manipulation via Frequently Bought TogetherEPSS 0.3%CVE-2026-84091MEDIUMSUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via bit IPNEPSS 0.3%CVE-2023-30560MEDIUM PCU Configuration Lacks AuthenticationEPSS 0.3%CVE-2026-54047CRITICALLaci Synchroni Backend Vulnerable to Account Takeover / User Impersonation via Client-Side Configuration ManipulationEPSS 0.3%CVE-2025-8964MEDIUMcode-projects Hostel Management System Login hostel_manage.exe improper authenticationEPSS 0.3%CVE-2023-43660MEDIUMSSH key password bypassed in warpgateEPSS 0.3%