Fallos del tipo CWE-287

2853 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2026-16823CRITICALSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.5%CVE-2025-12810MEDIUMFailure in Password Rotation and Check-in Mechanism in Secret Server Allows Reuse of CredentialsEPSS 0.5%CVE-2026-119096CRITICALUncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' ParameterEPSS 0.5%CVE-2026-1305MEDIUMJapanized for WooCommerce <= 2.8.4 - Missing Authorization to Unauthenticated Paidy Order ManipulationEPSS 0.5%CVE-2026-4021HIGHContest Gallery <= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type ConfusionEPSS 0.5%CVE-2023-23761HIGHImproper authentication vulnerability in GitHub Enterprise Server leading to modification of secret gistsEPSS 0.5%CVE-2026-21854CRITICALTarkov Data Manager Authentication Bypass vulnerabilityEPSS 0.5%CVE-2026-15315HIGHUnauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200EPSS 0.5%CVE-2025-70833CRITICALAn Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the aEPSS 0.5%CVE-2026-21582HIGHThis High severity BASM (Broken Authentication & Session Management) vulnerability known as CVE-2026-21582 was introduced in version 7.2.1 oEPSS 0.5%CVE-2026-2991HIGHKiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login TokenEPSS 0.5%CVE-2025-9803CRITICALImproper Authentication in lunary-ai/lunaryEPSS 0.5%CVE-2026-6274CRITICALAuthentication Bypass in DTS Electronics' Redline WR3200EPSS 0.5%CVE-2026-17099HIGHIBM i is Affected By Multiple Vulnerabilities in Navigator for iEPSS 0.5%CVE-2026-68569HIGHApache Tomcat: Principal lookup can fail open in some casesEPSS 0.5%CVE-2026-40138CRITICALCritical Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote AccessEPSS 0.5%CVE-2026-75907HIGHCVE-2026-75907EPSS 0.5%CVE-2026-96445MEDIUMKeycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headersEPSS 0.5%CVE-2017-20235CRITICALProSoft Technology ICX35-HWC Authentication BypassEPSS 0.5%CVE-2024-41800MEDIUMCraft CMS Allows TOTP Token To Stay Valid After UseEPSS 0.5%