Fallos del tipo CWE-287

2853 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2026-33117CRITICALAzure SDK for Java Security Feature Bypass VulnerabilityEPSS 0.5%CVE-2026-55075HIGHCoder vulnerable to OIDC account takeover via email-based user matching and email_verified bypassEPSS 0.5%CVE-2023-42662CRITICALJFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access TokensEPSS 0.5%CVE-2024-4129HIGHAuthentication bypass in Snow License ManagerEPSS 0.5%CVE-2026-30949HIGHParse Server is missing audience validation in Keycloak authentication adapterEPSS 0.5%CVE-2026-22752CRITICALSpring Security Authorization Server Dynamic Client Registration endpoints perform insufficient validation of client metadataEPSS 0.5%CVE-2024-50641HIGHAn authentication bypass vulnerability in PandoraNext-TokensTool v0.6.8 and before. An attacker can exploit this vulnerability to access APIEPSS 0.5%CVE-2026-107910CRITICALAuthentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handlingEPSS 0.5%CVE-2026-17358HIGHMultiple Vulnerabilities in IBM API ConnectEPSS 0.5%CVE-2026-101954CRITICALJunos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover when J-Web is enabledEPSS 0.5%CVE-2022-39892LOWImproper access control in Samsung Pass prior to version 4.0.05.1 allows attackers to unauthenticated access via keep open feature.EPSS 0.5%CVE-2023-21027HIGHIn multiple functions of PasspointXmlUtils.java, there is a possible authentication misconfiguration due to a logic error in the code. This EPSS 0.5%CVE-2026-72922HIGHAutoGPT: Webhook provider path confusion bypasses generic webhook secret verificationEPSS 0.5%CVE-2026-86723HIGHAVideo LoginControl PGP Authentication Bypass via verifyChallengeEPSS 0.5%CVE-2025-61665HIGHWeGIA: Broken Access Control in `get_relatorios_socios.php` EndpointEPSS 0.5%CVE-2026-48528CRITICALMetacat has an unauthenticated SQL injection vulnerabilityEPSS 0.5%CVE-2026-92914HIGHAVideo LoginControl PGP Second Factor Authentication BypassEPSS 0.5%CVE-2026-96228HIGHSSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account TakeoverEPSS 0.5%CVE-2026-86722HIGHAVideo Authentication Bypass via SQL Cache InvalidationEPSS 0.5%CVE-2026-91495CRITICALVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are EPSS 0.5%