Fallos del tipo CWE-287

2855 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2026-53512CRITICALBetter Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp pluginsEPSS 0.3%CVE-2026-14561MEDIUMAuthora - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover via OTP DisclosureEPSS 0.3%CVE-2025-0813HIGHCWE-287: Improper Authentication vulnerability exists that could cause an Authentication Bypass when an unauthorized user without permissionEPSS 0.3%CVE-2026-55457HIGHGoobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypassEPSS 0.3%CVE-2026-39324CRITICALRack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserializationEPSS 0.3%CVE-2025-7630MEDIUMOTP Password Brute Forcing in DorukNet's WispotterEPSS 0.3%CVE-2024-37408HIGHfprintd through 1.94.3 lacks a security attention mechanism, and thus unexpected actions might be authorized by "auth sufficient pam_fprintdEPSS 0.3%CVE-2026-35261MEDIUMVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that EPSS 0.3%CVE-2020-10709—A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application. Ansible Tower uses the token to proviEPSS 0.3%CVE-2026-62850MEDIUMFreeScout: Administrative tools.php endpoint is accessible to low-privileged users, enabling filesystem enumeration and unthrottled brute-force of application secretsEPSS 0.3%CVE-2026-60434MEDIUMVulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Authentication). The supported version thEPSS 0.3%CVE-2025-68663MEDIUMOutline has a suspended user authentication bypass via WebSocket connectionsEPSS 0.3%CVE-2022-29838MEDIUMAuthentication issue with the encrypted volumes and auto mount feature in My Cloud devicesEPSS 0.3%CVE-2026-44847HIGHMaxKB: Webhook Trigger Authentication BypassEPSS 0.3%CVE-2024-38426MEDIUMImproper Authentication in ModemEPSS 0.3%CVE-2026-97367MEDIUMKeycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeoverEPSS 0.3%CVE-2022-3681MEDIUMA vulnerability has been identified in the MR2600 router v1.0.18 and earlier that could allow an attacker within range of the wireless netwoEPSS 0.3%CVE-2026-40910MEDIUMfrp: Authentication bypass in frp HTTP vhost routing when routeByHTTPUser is used for access controlEPSS 0.3%CVE-2026-110863HIGHBetter Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO ProvidersEPSS 0.3%CVE-2024-38822LOWCVE-2024-38822 Salt AdvisoryEPSS 0.3%