Fallos del tipo CWE-287

2855 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2026-88827HIGHDisable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Application PasswordsEPSS 0.3%CVE-2026-111949HIGHminiOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor RebindingEPSS 0.3%CVE-2026-116163CRITICALParse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter SubclassesEPSS 0.3%CVE-2026-18651MEDIUM389-ds-base: 389-ds-base: sasl plain bind installs connection credentials before account-lock check, allowing continued access as a locked accountEPSS 0.3%CVE-2025-48746MEDIUMNetwrix Directory Manager (formerly Imanami GroupID) v.11.0.0.0 and before, as well as after v.11.1.25134.03 lacks Authentication for a CritEPSS 0.3%CVE-2025-9815HIGHalaneuler batteryKid NSXPCListener PrivilegeHelper.swift missing authenticationEPSS 0.3%CVE-2026-14214LOWAmelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass AssignmentEPSS 0.3%CVE-2026-106488HIGHBackstage: Improper authentication in the OIDC providerEPSS 0.3%CVE-2024-40648MEDIUM`UserIdentity::is_verified` not checking verification status of own user identity while performing the check in matrix-rust-sdkEPSS 0.3%CVE-2020-7276MEDIUMUnrestricted Policy Management using MfeUpgradeTool.exeEPSS 0.3%CVE-2024-45347CRITICALMi Connect Service APP protocol flaws lead to unauthorized accessEPSS 0.3%CVE-2026-24003MEDIUMEvseV2G has sequence state validation bypassEPSS 0.3%CVE-2026-31773HIGHBluetooth: SMP: derive legacy responder STK authentication from MITM stateEPSS 0.3%CVE-2026-41896HIGHCoolify: Unauthenticated Deployment Trigger via Webhook HMAC Bypass with Null SecretEPSS 0.3%CVE-2025-65128HIGHA missing authentication mechanism in the web management API components of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows unautheEPSS 0.3%CVE-2023-28647MEDIUMApp pin of the iOS app can be bypassed in Nextcloud iOSEPSS 0.3%CVE-2026-115237CRITICALGrand Job <= 1.2.1 - Unauthenticated Account Takeover via Empty Password Reset CodeEPSS 0.3%CVE-2023-52111HIGHAuthorization vulnerability in the BootLoader module. Successful exploitation of this vulnerability may affect service integrity.EPSS 0.3%CVE-2024-13088MEDIUMQHoraEPSS 0.3%CVE-2026-90623MEDIUMandreashappe cochise SSH Host Key ssh_connection.py asyncssh.connect certificate validationEPSS 0.3%