Fallos del tipo CWE-346

588 resultados

Validação incorreta de origem (Origin Validation Error)

A aplicação falha em validar corretamente a origem (origem HTTP, domínio, referência) de requisições ou recursos, permitindo que um atacante simule estar vindo de uma origem confiável. Isso quebra mecanismos de segurança como CORS, CSRF e validações de referência, abrindo porta para ataques cross-site.

Ejemplo

Um banco implementa proteção CSRF verificando se o header `Origin` é igual a `banco.com.br`, mas não valida subdomínios. Um atacante consegue fazer requisições de `falso.banco.com.br` que passam na validação e transferem dinheiro da vítima.

Cómo mitigar

Valide a origem de forma rigorosa usando whitelist explícita (não apenas prefixos ou sufixos), implemente tokens CSRF anti-previsíveis, configure CORS corretamente evitando `Access-Control-Allow-Origin: *`, e use SameSite cookies quando possível.

CVE-2026-52843CRITICALLightpanda: fetch() and XMLHttpRequest attach session cookies to cross-origin requests regardless of credentials modeEPSS 0.2%CVE-2026-56179HIGHWindows Network Address Translation (NAT) Spoofing VulnerabilityEPSS 0.2%CVE-2026-54007HIGHOpen WebUI: Cross-origin postMessage confirmation bypass via action:submitEPSS 0.2%CVE-2026-14105CRITICALInsufficient policy enforcement in Speech in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy viaEPSS 0.2%CVE-2026-59950HIGHMCP Python SDK: WebSocket server transport does not support Host/Origin validationEPSS 0.2%CVE-2025-23117MEDIUMAn Insufficient Firmware Update Validation vulnerability could allow an authenticated malicious actor with access to UniFi Protect Cameras aEPSS 0.2%CVE-2026-18676MEDIUMKong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost adminEPSS 0.2%CVE-2026-2790HIGHSame-origin policy bypass in the Networking: JAR componentEPSS 0.2%CVE-2026-92359LOWag-ui-protocol ag-ui CORSMiddleware utils.py create_strands_app cross-domain policyEPSS 0.2%CVE-2026-17783MEDIUMInappropriate implementation in Loader in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a craEPSS 0.2%CVE-2026-17817MEDIUMInappropriate implementation in ReportingAndNEL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data EPSS 0.2%CVE-2026-17823MEDIUMInsufficient policy enforcement in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via EPSS 0.2%CVE-2026-17833MEDIUMInappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a EPSS 0.2%CVE-2026-46701HIGHNetwork-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default SecretEPSS 0.2%CVE-2026-13321HIGHDNSSEC Validation Bypass via Out-of-Zone NSEC Next FieldEPSS 0.2%CVE-2025-2346MEDIUMIROAD Dash Cam X5/Dash Cam X6 Domain origin validationEPSS 0.2%CVE-2025-63388CRITICALA Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. ThEPSS 0.2%CVE-2026-6508CRITICALRCE in TUBITAK BILGEM's LiderahenkEPSS 0.2%CVE-2026-55438MEDIUMCoder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofingEPSS 0.2%CVE-2025-10193HIGHNeo4j Cypher MCP server is vulnerable to DNS rebinding attacksEPSS 0.2%