Fallos del tipo CWE-287

2855 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2023-43660MEDIUMSSH key password bypassed in warpgateEPSS 0.3%CVE-2025-68402HIGHFreshRSS has an authentication bypass due to truncated bcrypt hash [edge branch]EPSS 0.3%CVE-2026-46972HIGHVulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suite (component: Internal Operations). SupEPSS 0.3%CVE-2026-79974MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper AuthentiEPSS 0.3%CVE-2026-32879MEDIUMNew API has passkey-based secure step-up verification bypass for root-only channel secret disclosureEPSS 0.3%CVE-2026-107228MEDIUMAsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)EPSS 0.3%CVE-2026-22099HIGHMissing authentication for Bluetooth communicationEPSS 0.3%CVE-2026-123802HIGHSuperTokens Core SAML: identity taken from an assertion that never passed the audience check, allowing sign-in as any IdP userEPSS 0.3%CVE-2026-85301MEDIUMApache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss ClaimEPSS 0.3%CVE-2026-82980MEDIUMAny authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves fEPSS 0.3%CVE-2026-113965MEDIUMThis issue was addressed with improved checks. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2EPSS 0.3%CVE-2026-60908HIGHVulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions that arEPSS 0.3%CVE-2026-114616HIGHAuthlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)EPSS 0.3%CVE-2024-56445MEDIUMInstruction authentication bypass vulnerability in the Findnetwork module Impact: Successful exploitation of this vulnerability may cause feEPSS 0.3%CVE-2026-97343MEDIUMBurst Statistics <= 3.7.1 - Improper Authentication to Account Persistence via Share-Link Authentication Bypass via 'burst_share_token'EPSS 0.3%CVE-2026-44196CRITICALPingvin Share X: TOTP Authentication Bypass via Password-only LoginEPSS 0.3%CVE-2026-57107HIGHWindows Admin Center Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-49443HIGHauthentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the APIEPSS 0.3%CVE-2026-32072MEDIUMActive Directory Spoofing VulnerabilityEPSS 0.3%CVE-2026-61049HIGHVulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations). Supported versions tEPSS 0.3%