Fallos del tipo CWE-305

168 resultados

Bypass de autenticação por fraqueza secundária

A autenticação em si é criptograficamente correta, mas pode ser contornada por outra vulnerabilidade no código ou na lógica da aplicação. Exemplo: validar corretamente a senha, mas aceitar um token expirado, ou checar credenciais mas não validar a origem da requisição. O risco é que o atacante não quebra o algoritmo — ele encontra uma porta dos fundos.

Ejemplo

Sistema que valida login com hash bcrypt impecável, mas depois aceita qualquer usuário se um parâmetro GET 'admin=true' estiver presente. Ou API que verifica JWT corretamente, mas esquece de validar se a sessão foi revogada no servidor.

Cómo mitigar

Revise toda a lógica de fluxo após a autenticação: não confie apenas no algoritmo criptográfico. Valide o contexto (origem, timestamp, revogação), execute testes de penetração focados em bypass (parâmetros extras, header manipulation, race conditions) e implemente lista de controle de acesso (ACL) robusta em cada endpoint sensível.

CVE-2026-0869HIGHApplication User custom defined accounts are not properly password protected in Brocade ASCG 3.4.0EPSS 0.4%CVE-2026-6266HIGHAap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linkingEPSS 0.4%CVE-2026-8932HIGHincomplete mTLS config matching in conn reuseEPSS 0.4%CVE-2024-5956MEDIUMThis vulnerability allows unauthenticated remote attackers to bypass authentication and gain partial data access to the vulnerable Trellix IEPSS 0.4%CVE-2024-5957MEDIUMThis vulnerability allows unauthenticated remote attackers to bypass authentication and gain APIs access of the Manager.EPSS 0.4%CVE-2026-33496HIGHOry Oathkeeper has an authentication bypass by cache key confusionEPSS 0.4%CVE-2023-28727CRITICALPanasonic AiSEG2 versions 2.00J through 2.93A allows adjacent attackers bypass authentication due to mishandling of X-Forwarded-For headers.EPSS 0.4%CVE-2025-14600CRITICALAdmin Account Takeover via Path Traversal in vsDeskEPSS 0.4%CVE-2022-38700HIGHmultimedia subsystem has a permission bypass vulnerability. LAN attackers can bypass permission control and get control of camera service.EPSS 0.4%CVE-2024-6637HIGHWooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time PasswordEPSS 0.4%CVE-2025-52996LOWFile Browser's Password Protection of Links Vulnerable to BypassEPSS 0.4%CVE-2026-32730HIGHApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token MiddlewareEPSS 0.4%CVE-2026-3591MEDIUMA stack use-after-return flaw in SIG(0) handling code may enable ACL bypassEPSS 0.4%CVE-2024-20463MEDIUMCisco ATA 190 Series Analog Telephone Adapter Firmware Command Injection and Denial of Service VulnerabilityEPSS 0.4%CVE-2026-9798MEDIUMKeycloak: keycloak: brute-force protection bypass in ciba flowEPSS 0.3%CVE-2026-16103MEDIUMKeycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemptionEPSS 0.3%CVE-2025-30428MEDIUMThis issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6. Photos in the HiEPSS 0.3%CVE-2025-27371MEDIUMIn certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0 Client Authentication mechanism is used, theEPSS 0.3%CVE-2025-27370MEDIUMOpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations. When the private_key_jwt authentication mechanEPSS 0.3%CVE-2025-4658CRITICALAuthentication Bypass in OPKSSHEPSS 0.3%