Fallos del tipo CWE-305

168 resultados

Bypass de autenticação por fraqueza secundária

A autenticação em si é criptograficamente correta, mas pode ser contornada por outra vulnerabilidade no código ou na lógica da aplicação. Exemplo: validar corretamente a senha, mas aceitar um token expirado, ou checar credenciais mas não validar a origem da requisição. O risco é que o atacante não quebra o algoritmo — ele encontra uma porta dos fundos.

Ejemplo

Sistema que valida login com hash bcrypt impecável, mas depois aceita qualquer usuário se um parâmetro GET 'admin=true' estiver presente. Ou API que verifica JWT corretamente, mas esquece de validar se a sessão foi revogada no servidor.

Cómo mitigar

Revise toda a lógica de fluxo após a autenticação: não confie apenas no algoritmo criptográfico. Valide o contexto (origem, timestamp, revogação), execute testes de penetração focados em bypass (parâmetros extras, header manipulation, race conditions) e implemente lista de controle de acesso (ACL) robusta em cada endpoint sensível.

CVE-2024-12776HIGHAuthentication Bypass in langgenius/difyEPSS 0.7%CVE-2023-36497HIGHDover Fueling Solutions MAGLINK LX Web Console Authentication Bypass by Primary WeaknessEPSS 0.6%CVE-2023-7103CRITICALAuthentication Bypass in ZKSoftware's UFace 5EPSS 0.6%CVE-2025-53534HIGHRatPanel can perform remote command execution without authorizationEPSS 0.6%CVE-2023-2959HIGHAuthentication Bypass by Primary Weakness in Oliva ExpertiseEPSS 0.6%CVE-2024-39899MEDIUMPrivateBin allows shortening of URLs for other domainsEPSS 0.6%CVE-2025-41733CRITICALPossible malfunction credential injectionEPSS 0.6%CVE-2026-78619CRITICALPunk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numericallyEPSS 0.6%CVE-2025-58382HIGHPrivilege escalation in Brocade Fabric before 9.2.1c2 and 9.2.2 through 9.2.2aEPSS 0.6%CVE-2024-51738HIGHSunshine improperly enforces pairing protocol request orderEPSS 0.6%CVE-2025-31192MEDIUMThe issue was addressed with improved checks. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A website maEPSS 0.6%CVE-2024-42513MEDIUMVulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication whenEPSS 0.6%CVE-2026-85500CRITICAL`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthenticationEPSS 0.5%CVE-2022-40723MEDIUMConfiguration-based MFA Bypass in PingID RADIUS PCV.EPSS 0.5%CVE-2025-36386CRITICALThere is a vulnerability in the IBM Maximo Manage application in IBM Maximo Application Suite for Cognos AnalyticsEPSS 0.5%CVE-2023-4939MEDIUMSALESmanago <= 3.2.4 - Log Injection via Weak Authentication TokenEPSS 0.5%CVE-2025-4320CRITICALInformation Disclosure in Birebirsoft's SufirmamEPSS 0.5%CVE-2026-40582CRITICALChurchCRM: Authentication Bypass in `/api/public/user/login` Allows Bypass of 2FA and Account LockoutEPSS 0.5%CVE-2025-53826HIGHFileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after LogoutEPSS 0.5%CVE-2024-12802CRITICALSSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (SecurEPSS 0.5%