Fallos del tipo CWE-287

2809 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2024-45369CRITICALmySCADA myPRO Improper AuthenticationEPSS 0.6%CVE-2026-54600HIGHWallos: Unauthenticated database replacement via import endpoint on fresh installEPSS 0.6%CVE-2025-63210CRITICALThe Newtec Celox UHD (models: CELOXA504, CELOXA820) running firmware version celox-21.6.13 is vulnerable to an authentication bypass. An attEPSS 0.6%CVE-2026-88920CRITICALApache WSS4J: SAML Sender-Vouches Authentication BypassEPSS 0.6%CVE-2025-11852MEDIUMApeman ID71 ONVIF Service device_service missing authenticationEPSS 0.6%CVE-2026-77194MEDIUMSimple Membership <= 4.8.1 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity BindingEPSS 0.6%CVE-2026-65633HIGHPurpose-limited JWT accepted as full bearer authentication in AshAuthenticationEPSS 0.6%CVE-2024-37019CRITICALNorthern.tech Mender Enterprise before 3.6.4 and 3.7.x before 3.7.4 has Weak Authentication.EPSS 0.6%CVE-2024-47218CRITICALAn issue was discovered in vesoft NebulaGraph through 3.8.0. It allows bypassing authentication.EPSS 0.6%CVE-2026-123032MEDIUMOpenBMB Internet of Agents WebSocket Connection Manager app.py ConnectionManager.connect missing authenticationEPSS 0.6%CVE-2026-114248MEDIUMdhikshitha29 Insurance-Management-System Plan Management Form AddNewPlan-inc.php missing authenticationEPSS 0.6%CVE-2026-96404HIGHGitea installer authentication bypass for existing accountsEPSS 0.6%CVE-2026-78885MEDIUMliketrek TREK OIDC Service oidcService.ts findOrCreateUser improper authenticationEPSS 0.6%CVE-2022-30124MEDIUMAn improper authentication vulnerability exists in Rocket.Chat Mobile App <4.14.1.22788 that allowed an attacker with physical access to a mEPSS 0.6%CVE-2026-15348MEDIUMPremium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' ParameterEPSS 0.6%CVE-2024-12287CRITICALBiagiotti Membership <= 1.0.2 - Authentication Bypass via biagiotti_membership_check_facebook_userEPSS 0.6%CVE-2021-25368LOWHijacking vulnerability in Samsung Cloud prior to version 4.7.0.3 allows attackers to intercept when the provider is executed.EPSS 0.6%CVE-2026-16015MEDIUMpoco-ai poco-claw executor_manager API tasks.py create_task missing authenticationEPSS 0.6%CVE-2026-68300CRITICALsctp: auth: verify auth requirement when auth_chunk is NULLEPSS 0.6%CVE-2026-75774MEDIUMkarakeep-app karakeep OAuth Sign-In auth.ts improper authenticationEPSS 0.6%