Fallos del tipo CWE-287

2809 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2026-86709CRITICALThe Pressengine <= 1.0 - Unauthenticated Authentication BypassEPSS 0.6%CVE-2026-53483CRITICALDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1EPSS 0.6%CVE-2026-17101HIGHIBM i is Affected By Multiple Vulnerabilities in Navigator for iEPSS 0.6%CVE-2026-77001CRITICALSocial Login & Sharing buttons with Analytics By SoClever <= 1.2.0 - Unauthenticated Authentication BypassEPSS 0.6%CVE-2026-75800CRITICALFrontegg SAML SSO <= 1.0.1 - Unauthenticated Account Takeover via Unverified SAMLResponseEPSS 0.6%CVE-2024-22442CRITICALThe vulnerability could be remotely exploited to bypass authentication.EPSS 0.6%CVE-2026-2174MEDIUMcode-projects Contact Management System CRUD Endpoint improper authenticationEPSS 0.6%CVE-2023-1065MEDIUMThis vulnerability in the Snyk Kubernetes Monitor can result in irrelevant data being posted to a Snyk Organization, which could in turn obfEPSS 0.6%CVE-2025-8348MEDIUMKehua Charging Pile Cloud Platform home improper authenticationEPSS 0.6%CVE-2022-3674HIGHSourceCodester Sanitization Management System missing authenticationEPSS 0.6%CVE-2024-2873CRITICALUser authentication bypass in wolfSSH serverEPSS 0.6%CVE-2024-51996HIGHSymphony has an Authentication Bypass via RememberMeEPSS 0.6%CVE-2026-55652CRITICALWekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)EPSS 0.6%CVE-2024-11209MEDIUMApereo CAS 2FA login improper authenticationEPSS 0.6%CVE-2023-1477HIGHImproper Authentication vulnerability in HYPR Keycloak Authenticator Extension allows Authentication Abuse.This issue affects HYPR Keycloak EPSS 0.6%CVE-2023-25913HIGHAuthentication Bypass in Danfoss AK-SM800AEPSS 0.6%CVE-2022-4441HIGHPrivilege Escalation Vulnerability in Hitachi Storage Plug-in for VMware vCenterEPSS 0.6%CVE-2024-6576HIGHMOVEit Transfer Privilege Escalation VulnerabilityEPSS 0.6%CVE-2020-22657CRITICALIn Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, RuckusEPSS 0.6%CVE-2026-16867HIGHIBM i is Affected By Multiple Vulnerabilities in NetServerEPSS 0.6%