Fallos del tipo CWE-287

2853 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2026-8737MEDIUMSanluan PublicCMS Trade Address Query TradeAddressListDirective.java execute missing authenticationEPSS 0.4%CVE-2024-42336HIGHServision - CWE-287: Improper AuthenticationEPSS 0.4%CVE-2023-38367MEDIUMIBM Cloud Pak for Automation authentication bypassEPSS 0.4%CVE-2026-46903HIGHVulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infrastructure Security). SuppoEPSS 0.4%CVE-2026-108709CRITICALApache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)EPSS 0.4%CVE-2026-91213HIGHVulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: BPM Composer). Supported versEPSS 0.4%CVE-2026-56223CRITICALCapgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-userEPSS 0.4%CVE-2024-37313HIGHNextcloud server allows the by-pass the second factorEPSS 0.4%CVE-2026-46952HIGHVulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affectEPSS 0.4%CVE-2026-55377HIGHLogto: Account Center MFA management step-up bypass via WebAuthn registration verificationEPSS 0.4%CVE-2022-25685HIGHDenial of service in Modem module due to improper authorization while error handling in Snapdragon Auto, Snapdragon Compute, Snapdragon ConsEPSS 0.4%CVE-2026-11618MEDIUMDTStack Taier Source Connection Test Endpoint LoginInterceptor.java preHandle improper authenticationEPSS 0.4%CVE-2025-31271HIGHThis issue was addressed through improved state management. This issue is fixed in macOS Tahoe 26. Incoming FaceTime calls can appear or be EPSS 0.4%CVE-2026-27856HIGHDoveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determineEPSS 0.4%CVE-2024-42172MEDIUMHCL MyXalytics is affected by broken authenticationEPSS 0.4%CVE-2026-10617MEDIUMnextlevelbuilder GoClaw Webhook Verification auth.go resolveAuth missing authenticationEPSS 0.4%CVE-2025-60306CRITICALcode-projects Simple Car Rental System 1.0 has a permission bypass issue where low privilege users can forge high privilege sessions and perEPSS 0.4%CVE-2025-7699HIGHAn improper access control vulnerability was found in the EZ Sync Manager of ADMEPSS 0.4%CVE-2025-62717LOWEmlog Pro session verification code error due to clearing logic errorEPSS 0.4%CVE-2026-5000MEDIUMPromtEngineer localGPT API Endpoint server.py LocalGPTHandler missing authenticationEPSS 0.4%