Fallos del tipo CWE-305

168 resultados

Bypass de autenticação por fraqueza secundária

A autenticação em si é criptograficamente correta, mas pode ser contornada por outra vulnerabilidade no código ou na lógica da aplicação. Exemplo: validar corretamente a senha, mas aceitar um token expirado, ou checar credenciais mas não validar a origem da requisição. O risco é que o atacante não quebra o algoritmo — ele encontra uma porta dos fundos.

Ejemplo

Sistema que valida login com hash bcrypt impecável, mas depois aceita qualquer usuário se um parâmetro GET 'admin=true' estiver presente. Ou API que verifica JWT corretamente, mas esquece de validar se a sessão foi revogada no servidor.

Cómo mitigar

Revise toda a lógica de fluxo após a autenticação: não confie apenas no algoritmo criptográfico. Valide o contexto (origem, timestamp, revogação), execute testes de penetração focados em bypass (parâmetros extras, header manipulation, race conditions) e implemente lista de controle de acesso (ACL) robusta em cada endpoint sensível.

CVE-2019-14833MEDIUMA flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user EPSS 1.9%CVE-2026-25555CRITICALOpenBullet2 0.3.2 Authentication Bypass via X-Api-Key HeaderEPSS 1.8%CVE-2023-27535MEDIUMAn authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials beiEPSS 1.6%CVE-2023-27536MEDIUMAn authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connectiEPSS 1.6%CVE-2020-24683CRITICALAuthentication Bypass in Symphony PlusEPSS 1.5%CVE-2020-15787—A vulnerability has been identified in SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently validate auEPSS 1.5%CVE-2026-30849CRITICALMantisBT SOAP API has an authentication bypass vulnerability on MySQLEPSS 1.5%CVE-2021-21403HIGHAuthentication Bypass by Primary Weakness in github.com/kongchuanhujiao/serverEPSS 1.4%CVE-2023-27538HIGHAn authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite theEPSS 1.3%CVE-2021-3547—OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unreEPSS 1.2%CVE-2020-15077—OpenVPN Access Server 2.8.7 and earlier versions allows a remote attackers to bypass authentication and access control channel data on serveEPSS 1.2%CVE-2024-34077HIGHMantisBT user account takeover in the signup/reset password processEPSS 1.2%CVE-2021-43175—The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action thEPSS 1.2%CVE-2021-26726HIGHRemote code execution in Valmet DNA before Collection 2021EPSS 1.1%CVE-2022-4722HIGHAuthentication Bypass by Primary Weakness in ikus060/rdiffwebEPSS 1.1%CVE-2024-50478CRITICALWordPress 1-Click Login: Passwordless Authentication plugin 1.4.5 - Broken Authentication vulnerabilityEPSS 1.1%CVE-2019-14909CRITICALA vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or vEPSS 1.1%CVE-2023-1307CRITICALAuthentication Bypass by Primary Weakness in froxlor/froxlorEPSS 1.1%CVE-2019-14910CRITICALA vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS froEPSS 1.1%CVE-2023-27582CRITICALFull authentication bypass if SASL authorization username is specifiedEPSS 1.0%