Fallos del tipo CWE-287

2853 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2026-85716LOWAsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verifiedEPSS 0.4%CVE-2026-10167MEDIUMOUSL-GROUP-BrinaryBrains School Student Management System MY_Controller Login.php sign_auth_cookie improper authenticationEPSS 0.4%CVE-2025-67822CRITICALA vulnerability in the Provisioning Manager component of Mitel MiVoice MX-ONE 7.3 (7.3.0.0.50) through 7.8 SP1 (7.8.1.0.14) could allow an uEPSS 0.4%CVE-2026-104797HIGHAdvanced Form Integration <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field ActionEPSS 0.4%CVE-2026-1743LOWDJI Mavic Mini/Air/Spark/Mini SE Enhanced Wi-Fi Pairing authentication replayEPSS 0.4%CVE-2026-116769CRITICALAuthentication bypass in Secure Access ServersEPSS 0.4%CVE-2026-14596HIGHDynamicKit for Elementor < 1.0.3 - Unauthenticated Account Takeover via Password Reset Link Host InjectionEPSS 0.4%CVE-2026-73054HIGHSiYuan before v3.7.4 Authentication Bypass via WebSocketEPSS 0.4%CVE-2025-51451CRITICALIn TOTOLINK EX1200T firmware 4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.EPSS 0.4%CVE-2026-77826HIGHRegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience ValidationEPSS 0.4%CVE-2026-55689MEDIUMOpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unsetEPSS 0.4%CVE-2025-14738MEDIUMConfiguration Disclosure Vulnerability in TP-Link WA850REEPSS 0.4%CVE-2025-30168MEDIUMParse Server has an OAuth login vulnerabilityEPSS 0.4%CVE-2026-15206HIGHSMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-MobileEPSS 0.4%CVE-2026-84606HIGHA privacy issue was addressed with improved handling of identifiers. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visiEPSS 0.4%CVE-2026-55666CRITICALRocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuthEPSS 0.4%CVE-2024-23767HIGHAn issue was discovered on HMS Anybus X-Gateway AB7832-F firmware version 3. The HICP protocol allows unauthenticated changes to a device's EPSS 0.4%CVE-2026-63439CRITICAL2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy VerificationEPSS 0.4%CVE-2026-112044MEDIUMdotnet eShop Catalog API Extensions.cs AddApplicationServices improper authenticationEPSS 0.4%CVE-2026-125075MEDIUMSourceCodester Smart Attendance System with QR Code Scanner Admin Account Creation create_admin.php getMessage missing authenticationEPSS 0.4%