Fallos del tipo CWE-287

2853 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2026-73655HIGHTrigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google LoginEPSS 0.5%CVE-2026-91665CRITICALVulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerabilEPSS 0.5%CVE-2025-64175HIGHGogs Vulnerable to 2FA Bypass via Recovery CodeEPSS 0.5%CVE-2026-76752CRITICALAuthentication Bypass Vulnerabilities in HPE Networking ClearPass Policy Manager Allow Unauthorized Administrative AccessEPSS 0.5%CVE-2026-100606CRITICALFlowise through 3.1.4 Authentication Bypass via SSO Email MatchEPSS 0.5%CVE-2026-84831HIGHMandatory MFA bypass before enrollmentEPSS 0.5%CVE-2023-39303MEDIUMQTS, QuTS hero, QuTScloudEPSS 0.5%CVE-2026-34121HIGHAuthentication Bypass in DS Configuration Service via HTTP Request Parsing Differential of TP-Link Tapo C520WS and C210EPSS 0.5%CVE-2025-27416MEDIUMAsking For Scratch Username And PasswordEPSS 0.5%CVE-2026-13600HIGHAutoNetTV Relay < 3.0.14 - Unauthenticated Privilege Escalation via Scheduled Sync CronEPSS 0.5%CVE-2026-76793HIGHFirebase Authentication < 1.7.1 - Unauthenticated Account Takeover via Firebase Email ClaimEPSS 0.5%CVE-2026-47159MEDIUMVaultwarden: Authentication Flow Information Disclosure in SSO Discovery Allows Organization Enumeration and Pre-Validation Token ExposureEPSS 0.5%CVE-2026-76338HIGHImproper Authentication through REST API Distributed Search Token Requests in Splunk EnterpriseEPSS 0.5%CVE-2026-103779HIGHDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 reEPSS 0.5%CVE-2026-73241HIGHFreeRDP: RDSTLS server authentication bypass: a credential-less Capabilities PDU is accepted at the auth step (fail-open `resultCode`)EPSS 0.5%CVE-2025-54419CRITICALNode-SAML Contains SAML Signature Verification VulnerabilityEPSS 0.5%CVE-2026-12255HIGHMainWP Child < 6.1.2 - Unauthenticated Administrator Authentication Bypass via Passwordless Site RegistrationEPSS 0.5%CVE-2024-49376HIGHAutolab Has Misconfigured Reset Password PermissionsEPSS 0.5%CVE-2024-11087HIGHminiOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon <= 200.3.9 - Authentication BypassEPSS 0.5%CVE-2026-73278CRITICALGitea WebAuthn bypass during OAuth and OIDC sign-inEPSS 0.5%