Fallos del tipo CWE-290

721 resultados

Autenticação inadequada sujeita a falsificação de identidade

Ocorre quando o mecanismo de autenticação é implementado de forma fraca ou incompleta, permitindo que um atacante se faça passar por outro usuário ou sistema sem precisar das credenciais legítimas. O risco é grave: qualquer um pode ganhar acesso não autorizado simplesmente contornando ou falsificando a identidade.

Ejemplo

Um app que autentica usuários apenas verificando um header HTTP customizado (tipo 'X-User-ID: 123') sem validação criptográfica real. Um atacante muda esse header para 'X-User-ID: admin' e consegue acesso à conta administrativa. Ou um serviço que aceita requisições apenas porque vêm de um IP específico, sem verificar certificados ou assinaturas.

Cómo mitigar

Use protocolos de autenticação estabelecidos (OAuth 2.0, JWT com assinatura, SAML) em vez de inventar o seu. Sempre valide credenciais no servidor com mecanismos criptográficos (hash, assinatura digital, certificados). Nunca confie em headers HTTP, IPs ou tokens não assinados como prova única de identidade.

CVE-2026-82180CRITICALIn Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFiEPSS 0.3%CVE-2026-39772MEDIUMWordPress Captcha by BestWebSoft plugin <= 5.2.8 - Bypass Vulnerability vulnerabilityEPSS 0.3%CVE-2026-116790CRITICALFreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITYEPSS 0.3%CVE-2023-49741LOWWordPress Coming soon and Maintenance mode plugin <= 3.7.3 - IP Filtering Bypass vulnerabilityEPSS 0.3%CVE-2026-119703MEDIUMxiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID HeaderEPSS 0.3%CVE-2023-47769LOWWordPress WP Maintenance plugin <= 6.1.3 - IP Filtering Bypass vulnerabilityEPSS 0.3%CVE-2024-45453LOWWordPress Maintenance Redirect plugin <= 2.0.1 - IP Bypass vulnerabilityEPSS 0.3%CVE-2026-105215CRITICALZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP CallbackEPSS 0.3%CVE-2026-110723HIGHIn `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from tEPSS 0.3%CVE-2025-68624MEDIUMN-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound emaEPSS 0.3%CVE-2026-95523MEDIUMWordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerabilityEPSS 0.3%CVE-2026-49353HIGH9Router: Local-Only Access Gate Bypass in 9router via Host Header SpoofINGEPSS 0.3%CVE-2025-50328HIGHA vulnerability in B1 Free Archiver v1.5.86 allows files extracted from downloaded archives to bypass Windows Mark of the Web (MotW) protectEPSS 0.3%CVE-2024-31802MEDIUMDESIGNA ABACUS v.18 and before allows an attacker to bypass the payment process via a crafted QR code.EPSS 0.3%CVE-2026-92395CRITICAL@fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnetEPSS 0.3%CVE-2025-11843HIGHTherefore™ Online and Therefore™ On-Premises contains an account impersonation issue, which could potentially allow the attacker to access all the stored dataEPSS 0.3%CVE-2026-102895CRITICALGPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated adminEPSS 0.3%CVE-2025-50454MEDIUMAn Authentication Bypass vulnerability in Blue Access' Cobalt X1 thru 02.000.187 allows an unauthorized attacker to log into the applicationEPSS 0.3%CVE-2026-8644CRITICALIBM WebSphere Application Server is affected by an identity spoofing vulnerabilityEPSS 0.3%CVE-2026-93511MEDIUMPremium Packages < 7.2.1 - Unauthenticated PayPal Webhook Signature Verification BypassEPSS 0.3%