Fallos del tipo CWE-305

179 resultados

Bypass de autenticação por fraqueza secundária

A autenticação em si é criptograficamente correta, mas pode ser contornada por outra vulnerabilidade no código ou na lógica da aplicação. Exemplo: validar corretamente a senha, mas aceitar um token expirado, ou checar credenciais mas não validar a origem da requisição. O risco é que o atacante não quebra o algoritmo — ele encontra uma porta dos fundos.

Ejemplo

Sistema que valida login com hash bcrypt impecável, mas depois aceita qualquer usuário se um parâmetro GET 'admin=true' estiver presente. Ou API que verifica JWT corretamente, mas esquece de validar se a sessão foi revogada no servidor.

Cómo mitigar

Revise toda a lógica de fluxo após a autenticação: não confie apenas no algoritmo criptográfico. Valide o contexto (origem, timestamp, revogação), execute testes de penetração focados em bypass (parâmetros extras, header manipulation, race conditions) e implemente lista de controle de acesso (ACL) robusta em cada endpoint sensível.

CVE-2025-53534HIGHRatPanel can perform remote command execution without authorizationEPSS 0.7%CVE-2021-28503HIGHIn Arista's EOS software affected releases, eAPI might skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.EPSS 0.7%CVE-2023-6153CRITICALAuthentication Bypass in TeoSOFT Software TeoBASEEPSS 0.7%CVE-2023-4898HIGHAuthentication Bypass by Primary Weakness in mintplex-labs/anything-llmEPSS 0.7%CVE-2023-4727HIGHCa: token authentication bypass vulnerabilityEPSS 0.7%CVE-2024-12776HIGHAuthentication Bypass in langgenius/difyEPSS 0.7%CVE-2023-36497HIGHDover Fueling Solutions MAGLINK LX Web Console Authentication Bypass by Primary WeaknessEPSS 0.6%CVE-2025-41733CRITICALPossible malfunction credential injectionEPSS 0.6%CVE-2023-7103CRITICALAuthentication Bypass in ZKSoftware's UFace 5EPSS 0.6%CVE-2023-4939MEDIUMSALESmanago <= 3.2.4 - Log Injection via Weak Authentication TokenEPSS 0.6%CVE-2025-58382HIGHPrivilege escalation in Brocade Fabric before 9.2.1c2 and 9.2.2 through 9.2.2aEPSS 0.6%CVE-2023-2959HIGHAuthentication Bypass by Primary Weakness in Oliva ExpertiseEPSS 0.6%CVE-2024-39899MEDIUMPrivateBin allows shortening of URLs for other domainsEPSS 0.6%CVE-2026-78619CRITICALPunk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numericallyEPSS 0.6%CVE-2024-51738HIGHSunshine improperly enforces pairing protocol request orderEPSS 0.6%CVE-2025-31192MEDIUMThe issue was addressed with improved checks. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A website maEPSS 0.6%CVE-2024-42513MEDIUMVulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication whenEPSS 0.6%CVE-2025-36386CRITICALThere is a vulnerability in the IBM Maximo Manage application in IBM Maximo Application Suite for Cognos AnalyticsEPSS 0.6%CVE-2025-53826HIGHFileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after LogoutEPSS 0.6%CVE-2026-3047HIGHOrg.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated loginEPSS 0.5%