Fallos del tipo CWE-287

2851 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2025-32879HIGHAn issue was discovered on COROS PACE 3 devices through 3.0808.0. It starts advertising if no device is connected via Bluetooth. This allowsEPSS 0.5%CVE-2024-9947HIGHProfilePress - Pro <= 4.11.1 - Authentication Bypass via WordPress.com OAuth providerEPSS 0.5%CVE-2026-56793HIGHDell OpenManage Server Administrator, versions prior to 11.1.0.2, contains an Improper Authentication vulnerability. An unauthenticated attaEPSS 0.5%CVE-2026-44058MEDIUMAuthentication bypass via admin auth userEPSS 0.5%CVE-2024-50644CRITICALzhisheng17 blog 3.0.1-SNAPSHOT has an authentication bypass vulnerability. An attacker can exploit this vulnerability to access API without EPSS 0.5%CVE-2026-14291HIGHSecurity Ninja (Premium) < 5.290 - Two-Factor Authentication Bypass via secnin_skip_2faEPSS 0.5%CVE-2026-120447CRITICALHotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification CodeEPSS 0.5%CVE-2025-6979HIGHCaptive Portal can allow authentication bypassEPSS 0.5%CVE-2025-6172CRITICALPermission vulnerability in the mobile application (com.afmobi.boomplayer) may lead to the risk of unauthorized operation.EPSS 0.5%CVE-2026-24241MEDIUMNVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an attacker could exploit an improper authentiEPSS 0.5%CVE-2025-12374CRITICALEmail Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification <= 2.0.44 - Authentication Bypass to Account TakeoverEPSS 0.5%CVE-2026-55445CRITICALQinglong: Incomplete fix for CVE-2026-3965: Improper AuthenticationEPSS 0.5%CVE-2025-56752CRITICALA vulnerability in the Ruijie RG-ES series switch firmware ESW_1.0(1)B1P39 enables remote attackers to fully bypass authentication mechanismEPSS 0.5%CVE-2026-56737HIGHphpMyFAQ's two-factor authentication login bypasses the password factorEPSS 0.5%CVE-2020-5224MEDIUMSession key exposure through session list in Django User SessionsEPSS 0.5%CVE-2024-11671MEDIUMImproper authentication in SQL data source MFA validation in Devolutions Remote Desktop Manager 2024.3.17 and earlier on Windows allows an aEPSS 0.5%CVE-2026-101763CRITICALVulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Cloud native deploymenEPSS 0.5%CVE-2026-49872MEDIUMApache APISIX: Improper authentication in cas-auth pluginEPSS 0.5%CVE-2022-46316CRITICALA thread security vulnerability exists in the authentication process. Successful exploitation of this vulnerability may affect data integritEPSS 0.5%CVE-2022-39231LOWParse Server subject to Improper Authentication allowing Auth adapter app ID validation to be circumventedEPSS 0.5%