Fallos del tipo CWE-287

2809 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2026-29792CRITICALFeathersjs has an OAuth Callback Account TakeoverEPSS 0.6%CVE-2026-2065MEDIUMFlycatcher Toys smART Pixelator Bluetooth Low Energy missing authenticationEPSS 0.6%CVE-2022-34331MEDIUMIBM Power FW security bypassEPSS 0.6%CVE-2026-80312HIGHApache Camel: Camel-OAuth Authentication Bypass via Fail-Open ProcessorsEPSS 0.6%CVE-2024-7050HIGHImproper Authentication vulnerability in OpenText OpenText Directory Services may allow Multi-factor Authentication Bypass in particular sceEPSS 0.6%CVE-2022-23540MEDIUMjsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()EPSS 0.6%CVE-2026-18056HIGHHivePress Authentication <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook AuthenticatorEPSS 0.6%CVE-2025-49851HIGHImproper Authentication in ControlID iDSecure On-premisesEPSS 0.6%CVE-2022-27839LOWImproper authentication vulnerability in SecretMode in Samsung Internet prior to version 16.2.1 allows attackers to access bookmark tab withEPSS 0.6%CVE-2026-116604MEDIUMSourceCodester Online Food Ordering System delete_admin.php missing authenticationEPSS 0.6%CVE-2024-27253CRITICALIBM Engineering Requirements Management DOORS Next is impacted by vulnerability in Reviews delete requestEPSS 0.6%CVE-2026-70482HIGHOpen WebUI: Account takeover via OAuth token exchange accepting tokens issued to any clientEPSS 0.6%CVE-2026-0589MEDIUMcode-projects Online Product Reservation System Administration Backend improper authenticationEPSS 0.6%CVE-2026-12597HIGHLoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via GitHub OAuth CallbackEPSS 0.6%CVE-2026-28408CRITICALWeGIA lacks authentication verification in adicionar_tipo_docs_atendido.phpEPSS 0.6%CVE-2025-41023MEDIUMAuthentication bypass in AutoGPT de ThesamurEPSS 0.6%CVE-2024-41199HIGHAn issue in Ocuco Innovation - JOBMANAGER.EXE v2.10.24.16 allows attackers to bypass authentication and escalate privileges to AdministratorEPSS 0.6%CVE-2022-46172MEDIUMauthentik allows existing authenticated users to create arbitrary accountsEPSS 0.6%CVE-2023-6155MEDIUMQuiz Maker < 6.4.9.5 - Unauthenticated Email Address DisclosureEPSS 0.6%CVE-2026-101499CRITICALVulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are aEPSS 0.6%