Fallos del tipo CWE-287

2806 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2026-86400CRITICALDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 reEPSS 0.9%CVE-2022-36093HIGHXWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution WizardEPSS 0.9%CVE-2022-23600MEDIUMLimited ability to spoof SAML authentication with missing audience verificationEPSS 0.9%CVE-2026-12761CRITICALminiOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.7.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Profile Completion OTP FlowEPSS 0.9%CVE-2018-16464—A missing access check in Nextcloud Server prior to 14.0.0 could lead to continued access to password protected link shares when the owner hEPSS 0.9%CVE-2024-5732MEDIUMClash Proxy Port improper authenticationEPSS 0.9%CVE-2026-37006CRITICALA vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker to achieve code exeEPSS 0.9%CVE-2025-6916HIGHTOTOLINK T6 formLoginAuth.htm Form_Login missing authenticationEPSS 0.9%CVE-2020-5148—SonicWall SSO-agent default configuration uses NetAPI to probe the associated IP's in the network, this client probing method allows a potenEPSS 0.9%CVE-2025-14746MEDIUMNingyuanda TC155 RTSP Live Video Stream Endpoint improper authenticationEPSS 0.9%CVE-2022-22523HIGHCarlo Gavazzi UWP 3.0 WebApp allows for authentication bypassEPSS 0.9%CVE-2023-21721MEDIUMMicrosoft OneNote Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2023-5329MEDIUMField Logic DataCube4 Web API improper authenticationEPSS 0.9%CVE-2022-38336HIGHAn access control issue in MobaXterm before v22.1 allows attackers to make connections to the server via the SSH or SFTP protocols without aEPSS 0.9%CVE-2021-28494CRITICALIn Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, authentication iEPSS 0.9%CVE-2025-34186CRITICALIlevia EVE X1/X5 Server 4.7.18.0.eden Authentication BypassEPSS 0.9%CVE-2022-41436CRITICALAn issue in OXHOO TP50 OXH1.50 allows unauthenticated attackers to access the administrative panel via browsing to the URL http://device_ip/EPSS 0.9%CVE-2023-28609CRITICALapi/auth.go in Ansible Semaphore before 2.8.89 mishandles authentication.EPSS 0.9%CVE-2025-64513CRITICALMilvus Proxy has Critical Authentication Bypass VulnerabilityEPSS 0.9%CVE-2026-15459HIGHWPMU DEV Dashboard <= 5.0.0 - Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= EndpointEPSS 0.9%