Fallos del tipo CWE-346

589 resultados

Validação incorreta de origem (Origin Validation Error)

A aplicação falha em validar corretamente a origem (origem HTTP, domínio, referência) de requisições ou recursos, permitindo que um atacante simule estar vindo de uma origem confiável. Isso quebra mecanismos de segurança como CORS, CSRF e validações de referência, abrindo porta para ataques cross-site.

Ejemplo

Um banco implementa proteção CSRF verificando se o header `Origin` é igual a `banco.com.br`, mas não valida subdomínios. Um atacante consegue fazer requisições de `falso.banco.com.br` que passam na validação e transferem dinheiro da vítima.

Cómo mitigar

Valide a origem de forma rigorosa usando whitelist explícita (não apenas prefixos ou sufixos), implemente tokens CSRF anti-previsíveis, configure CORS corretamente evitando `Access-Control-Allow-Origin: *`, e use SameSite cookies quando possível.

CVE-2026-6143MEDIUMfarion1231 cc-switch ProxyServer server.rs cross-domain policyEPSS 0.2%CVE-2026-12304CRITICALSame-origin policy bypass in the Networking: Cookies componentEPSS 0.2%CVE-2026-46555HIGHWhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltrationEPSS 0.2%CVE-2026-41700HIGHCross-Site WebSocket Hijacking in Spring for GraphQLEPSS 0.2%CVE-2025-7659HIGHOrigin Validation Error in GitLabEPSS 0.2%CVE-2026-77119MEDIUMNSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsetsEPSS 0.2%CVE-2025-14331MEDIUMSame-origin policy bypass in the Request Handling componentEPSS 0.2%CVE-2025-59957HIGHJunos OS: EX4600 Series and QFX5000 Series: An attacker with physical access can open a persistent backdoorEPSS 0.2%CVE-2026-84129CRITICALSite isolation issue in the DOM: Navigation componentEPSS 0.2%CVE-2026-84133CRITICALSite isolation issue in the DOM: Push Subscriptions componentEPSS 0.2%CVE-2026-32632MEDIUMGlances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS RebindingEPSS 0.2%CVE-2026-11693HIGHInappropriate implementation in Plugins in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer EPSS 0.2%CVE-2024-45495MEDIUMMSA FieldServer Gateway 5.0.0 through 6.5.2 allows cross-origin WebSocket hijacking.EPSS 0.2%CVE-2026-33314MEDIUMpyload-ng: Improper Authentication and Origin Validation ErrorEPSS 0.2%CVE-2026-11194MEDIUMInappropriate implementation in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crEPSS 0.2%CVE-2025-11304MEDIUMCodeCanyon/ui-lib Mentor LMS API cross-domain policyEPSS 0.2%CVE-2026-27478CRITICALUnity Catalog has a JWT Issuer Validation Bypass Allows Complete User ImpersonationEPSS 0.2%CVE-2026-35577MEDIUMMissing Host Header Validation in Apollo MCP Server for Localhost DeploymentsEPSS 0.2%CVE-2026-70599MEDIUMElectron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe OriginEPSS 0.2%CVE-2026-6662MEDIUMericc-ch copilot-api Token Endpoint server.ts cors cross-domain policyEPSS 0.2%