Fallos del tipo CWE-290

606 resultados

Autenticação inadequada sujeita a falsificação de identidade

Ocorre quando o mecanismo de autenticação é implementado de forma fraca ou incompleta, permitindo que um atacante se faça passar por outro usuário ou sistema sem precisar das credenciais legítimas. O risco é grave: qualquer um pode ganhar acesso não autorizado simplesmente contornando ou falsificando a identidade.

Ejemplo

Um app que autentica usuários apenas verificando um header HTTP customizado (tipo 'X-User-ID: 123') sem validação criptográfica real. Um atacante muda esse header para 'X-User-ID: admin' e consegue acesso à conta administrativa. Ou um serviço que aceita requisições apenas porque vêm de um IP específico, sem verificar certificados ou assinaturas.

Cómo mitigar

Use protocolos de autenticação estabelecidos (OAuth 2.0, JWT com assinatura, SAML) em vez de inventar o seu. Sempre valide credenciais no servidor com mecanismos criptográficos (hash, assinatura digital, certificados). Nunca confie em headers HTTP, IPs ou tokens não assinados como prova única de identidade.

CVE-2026-61428MEDIUMPraisonAI AgentMail before 4.6.78 Message Injection via WebhookEPSS 0.4%CVE-2024-32708LOWWordPress Maintenance Mode plugin <= 3.0.1 - IP Bypass vulnerabilityEPSS 0.4%CVE-2026-40460MEDIUMNGINX ngx_quic_module vulnerabilityEPSS 0.4%CVE-2023-51542MEDIUMWordPress Branda plugin <= 3.4.14 - IP Restriction Bypass vulnerabilityEPSS 0.4%CVE-2020-7326MEDIUMMcAfee MAR - Improperly implemented security checkEPSS 0.4%CVE-2023-41134MEDIUMWordPress Antispam Bee plugin <= 2.11.3 - Country IP Restriction Bypass vulnerabilityEPSS 0.4%CVE-2024-8908MEDIUMInappropriate implementation in Autofill in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafEPSS 0.4%CVE-2025-48937MEDIUMmatrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administratorEPSS 0.4%CVE-2024-55232MEDIUMAn IDOR vulnerability in the manage-notes.php module in PHPGurukul Online Notes Sharing Management System v1.0 allows unauthorized users to EPSS 0.4%CVE-2026-45063CRITICALSymfony: Identity Spoofing via Unanchored DN Regex in X509AuthenticatorEPSS 0.4%CVE-2026-8651LOWIPv6 Loopback Spoof via Trusted Host Header Bypasses Origin Check in MOVEit TransferEPSS 0.4%CVE-2024-20363MEDIUMMultiple Cisco products are affected by a vulnerability in the Snort Intrusion Prevention System (IPS) rule engine that could allow an unautEPSS 0.4%CVE-2024-7745MEDIUMMulti-Factor Authentication Bypass in Progress WS_FTP ServerEPSS 0.4%CVE-2026-22734HIGHCloud Foundry UAA SAML 2.0 Signature BypassEPSS 0.4%CVE-2024-55925HIGHAPI Security bypass through header manipulationEPSS 0.4%CVE-2025-43493MEDIUMThe issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, maEPSS 0.4%CVE-2026-76356HIGHAuthentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAREPSS 0.4%CVE-2025-46345MEDIUMAuth0 Account Link Extension JWT Invalid Signature ValidationEPSS 0.4%CVE-2024-43944LOWWordPress Maintenance & Coming Soon Redirect Animation plugin <= 2.3.3 - Bypass Vulnerability vulnerabilityEPSS 0.4%CVE-2025-25055MEDIUMAuthentication bypass by spoofing issue exists in FileMegane versions above 1.0.0.0 prior to 3.4.0.0, which may lead to user impersonation. EPSS 0.4%