Fallos del tipo CWE-287

2809 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2025-6533MEDIUMxxyopen/201206030 novel-plus CATCHA LoginController.java ajaxLogin authentication replayEPSS 0.6%CVE-2026-105034HIGHEnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial NumbersEPSS 0.6%CVE-2026-12595HIGHLoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via Discord OAuth CallbackEPSS 0.6%CVE-2026-20317CRITICALCisco Secure Workload Software Security Hardening Release August 2026 - Improper Authentication VulnerabilitiesEPSS 0.6%CVE-2022-0985—Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary mEPSS 0.6%CVE-2025-15581MEDIUMOrthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation. EPSS 0.6%CVE-2024-56336CRITICALA vulnerability has been identified in SINAMICS S200 (All versions with serial number beginning with SZVS8, SZVS9, SZVS0 or SZVSN and the FSEPSS 0.6%CVE-2026-48830CRITICALApache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requestsEPSS 0.6%CVE-2023-48865MEDIUMAn issue discovered in Reportico Till 8.1.0 allows attackers to obtain sensitive information via execute_mode parameter of the URL.EPSS 0.6%CVE-2026-72533HIGHPortainer Portainer CE - Authentication BypassEPSS 0.6%CVE-2026-97864MEDIUMGibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authenticationEPSS 0.6%CVE-2026-14627MEDIUMNousResearch hermes-agent Discord Platform Integration discord.py DiscordAdapter._is_allowed_user improper authenticationEPSS 0.6%CVE-2026-114260MEDIUMoretnom23 file-management-system-php AJAX ajax.php delete_folder missing authenticationEPSS 0.6%CVE-2026-47426HIGHOpenAM OAuth Client Impersonation via JWKS Resolver CacheEPSS 0.6%CVE-2026-84295CRITICALImproper Authentication in Progress WS_FTP ServerEPSS 0.6%CVE-2026-106013CRITICALJupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier ParameterEPSS 0.6%CVE-2026-28514CRITICALRocket.Chat: Users can login with any password via the EE ddp-streamer-serviceEPSS 0.6%CVE-2026-90474HIGHMCPHub before 1.0.32 OAuth 2.0 Authentication BypassEPSS 0.6%CVE-2026-108707CRITICALWukong_HRM through commit 186115e Authentication Bypass via ParamAspectEPSS 0.6%CVE-2026-83540HIGHwolfSSHd on Windows race condition leading to logon token reused across connectionsEPSS 0.6%