Fallos del tipo CWE-303

109 resultados

Implementação incorreta de algoritmos de autenticação

Ocorre quando o desenvolvedor implementa um algoritmo de autenticação de forma incorreta, desviando do padrão esperado ou cometendo erros lógicos na validação de credenciais. Isso pode permitir que atacantes contornem o mecanismo de autenticação através de entradas malformadas, race conditions ou falhas na comparação de senhas.

Ejemplo

Um sistema que compara senhas usando operadores de igualdade simples (==) em vez de funções timing-safe, permitindo timing attacks. Outro caso: validação de JWT que não verifica assinatura ou aceita algoritmo 'none'. Ou ainda, implementar autenticação multi-fator que deixa um caminho para bypass se a segunda autenticação falhar.

Cómo mitigar

Use bibliotecas de autenticação maduras e bem auditadas (passlib, bcrypt, argon2) em vez de implementar do zero. Aplique testes unitários e de segurança específicos para fluxos de autenticação, incluindo casos de falha. Faça code review focado em algoritmos criptográficos e nunca compare credenciais com == em linguagens tipo Python/Java — use funções timing-safe.

CVE-2024-10127CRITICALSupport for authentication bypass condition in M-Files LDAP authenticationEPSS 0.6%CVE-2024-5658MEDIUMCraftCMS Plugin - Two-Factor Authentication - TOTP Token Stays Valid After UseEPSS 0.6%CVE-2022-43635MEDIUMThis vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR940N 6_2111EPSS 0.6%CVE-2024-32879MEDIUMsocial-auth-app-django Improper Handling of Case Sensitivity vulnerabilityEPSS 0.6%CVE-2023-25957CRITICALA vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatibEPSS 0.6%CVE-2024-3046HIGHIn Eclipse Kura LogServlet component included in versions 5.0.0 to 5.4.1, a specifically crafted request to the servlet can allow an unautheEPSS 0.6%CVE-2024-35190MEDIUMAsterisk' res_pjsip_endpoint_identifier_ip: wrongly matches ALL unauthorized SIP requestsEPSS 0.6%CVE-2025-63210CRITICALThe Newtec Celox UHD (models: CELOXA504, CELOXA820) running firmware version celox-21.6.13 is vulnerable to an authentication bypass. An attEPSS 0.5%CVE-2022-4861MEDIUMIncorrect Implementation of Authentication AlgorithmEPSS 0.5%CVE-2026-3869CRITICALCWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity and EPSS 0.5%CVE-2023-39953MEDIUMIssuer not verified from obtained token in user_oidcEPSS 0.5%CVE-2026-0073HIGHIn adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. ThisEPSS 0.5%CVE-2026-47300HIGHASP.NET Core Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-41053HIGHOver-inclusive team membership expansion in GitHub App authentication provider for RancherEPSS 0.5%CVE-2023-31211HIGHDisabled automation users could still authenticateEPSS 0.5%CVE-2026-35579HIGHCoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transportsEPSS 0.5%CVE-2026-11430MEDIUMGrav CMS Scheduler Webhook Authentication Bypass via Null Short-CircuitEPSS 0.5%CVE-2026-43640HIGHBitwarden Server < 2026.4.1 Authentication Bypass via SCIM API KeyEPSS 0.5%CVE-2026-46595CRITICALInvoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/sshEPSS 0.5%CVE-2024-25157MEDIUMAuthentication bypass in GoAnywhere MFT prior to 7.6.0EPSS 0.5%