Fallos del tipo CWE-290

721 resultados

Autenticação inadequada sujeita a falsificação de identidade

Ocorre quando o mecanismo de autenticação é implementado de forma fraca ou incompleta, permitindo que um atacante se faça passar por outro usuário ou sistema sem precisar das credenciais legítimas. O risco é grave: qualquer um pode ganhar acesso não autorizado simplesmente contornando ou falsificando a identidade.

Ejemplo

Um app que autentica usuários apenas verificando um header HTTP customizado (tipo 'X-User-ID: 123') sem validação criptográfica real. Um atacante muda esse header para 'X-User-ID: admin' e consegue acesso à conta administrativa. Ou um serviço que aceita requisições apenas porque vêm de um IP específico, sem verificar certificados ou assinaturas.

Cómo mitigar

Use protocolos de autenticação estabelecidos (OAuth 2.0, JWT com assinatura, SAML) em vez de inventar o seu. Sempre valide credenciais no servidor com mecanismos criptográficos (hash, assinatura digital, certificados). Nunca confie em headers HTTP, IPs ou tokens não assinados como prova única de identidade.

CVE-2025-10530MEDIUMSpoofing issue in the WebAuthn component in Firefox for AndroidEPSS 0.3%CVE-2026-47845MEDIUMReactor Netty HTTP Server may incorrectly evaluate proxy addressesEPSS 0.3%CVE-2022-1745MEDIUM2.2.7 AUTHENTICATION BYPASS BY SPOOFING CWE-290EPSS 0.3%CVE-2026-103302MEDIUMPayment Gateway for Idram < 2.1.6 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant SecretEPSS 0.3%CVE-2024-22457HIGHDell Secure Connect Gateway 5.20 contains an improper authentication vulnerability during the SRS to SCG update path. A remote low privilegeEPSS 0.3%CVE-2023-28803MEDIUMTraffic being bypassed by ZCC by configuring synthetic IP range as local networkEPSS 0.3%CVE-2026-97274CRITICALWordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerabilityEPSS 0.3%CVE-2026-58593HIGHNodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local UserEPSS 0.3%CVE-2026-100390CRITICALZoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6EPSS 0.3%CVE-2020-7327MEDIUMMcAfee MVEDR - Improperly implemented security checkEPSS 0.3%CVE-2026-84849MEDIUMWordPress Pre-Orders for WooCommerce plugin <= 2.3 - Bypass Vulnerability vulnerabilityEPSS 0.3%CVE-2025-29621HIGHFrancois Jacquet RosarioSIS v12.0.0 was discovered to contain a content spoofing vulnerability in the Theme configuration under the My PrefeEPSS 0.3%CVE-2026-123578MEDIUMHickory DNS 0.26.0 before 0.26.2 Response Validation Bypass via QDCOUNT=0EPSS 0.3%CVE-2026-34025MEDIUMIP restriction bypass in Wertheim SafeController Software allows logins from unauthorized network locationsEPSS 0.3%CVE-2020-6158MEDIUMOpera Mini for Android before version 52.2 is vulnerable to an address bar spoofing attack. The vulnerability allows a malicious page to triEPSS 0.3%CVE-2025-30142HIGHAn issue was discovered on G-Net Dashcam BB GONX devices. Bypassing of Device Pairing can occur. It uses MAC address verification as the solEPSS 0.3%CVE-2026-104891HIGHmppx-condition-gate: Free-access path grants on a self-declared wallet without proving controlEPSS 0.3%CVE-2023-29147—In Malwarebytes EDR 1.0.11 for Linux, it is possible to bypass the detection layers that depend on inode identifiers, because an identifier EPSS 0.3%CVE-2024-9391MEDIUMA user who enables full-screen mode on a specially crafted web page could potentially be prevented from exiting full screen mode. This may EPSS 0.3%CVE-2026-85511MEDIUMWildfly-elytron-realm-token: parameter injection in eap's elytron oauth2EPSS 0.3%