Fallos del tipo CWE-640

248 resultados

Mecanismo fraco de recuperação de senha

A aplicação usa um processo de recuperação de senha insuficientemente seguro, permitindo que um atacante redefina a senha de outro usuário sem autenticação adequada. Isso acontece quando perguntas de segurança são previsíveis, tokens de recuperação não expiram, ou a validação de identidade é inadequada — abrindo caminho para takeover de conta.

Ejemplo

Um banco que envia um link de reset com token válido por 30 dias, ou um e-commerce que valida recuperação apenas perguntando a data de nascimento do cadastro (informação frequentemente pública). Um atacante consegue acessar contas alheias explorando essas fraquezas.

Cómo mitigar

Use tokens criptograficamente fortes e com expiração curta (15-60 min), exija confirmação em múltiplos canais (SMS + email), implemente rate limiting para tentativas de reset, e evite perguntas de segurança previsíveis ou públicas. Valide a identidade com dados realmente privados ou biometria quando possível.

CVE-2024-2463HIGHWeak password recovery mechanism in CDeXEPSS 0.6%CVE-2024-0491MEDIUMHuaxia ERP UserController.java password recoveryEPSS 0.6%CVE-2026-86260MEDIUMsfturing hosp_order Password Recovery CommonUserController.java modifyPassWord unverified password changeEPSS 0.6%CVE-2026-7459HIGHSimple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction EndpointEPSS 0.6%CVE-2025-64113CRITICALEmby Server allows attackers to gain administrative server access without preconditionsEPSS 0.6%CVE-2026-86055HIGHPart-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account TakeoverEPSS 0.6%CVE-2025-31380CRITICALWordPress Paid Videochat Turnkey Site plugin <= 7.3.11 - Broken Authentication VulnerabilityEPSS 0.6%CVE-2025-4552MEDIUMContiNew Admin password unverified password changeEPSS 0.6%CVE-2026-1325MEDIUMSangfor Operation and Maintenance Security Management System edit_pwd_mall password recoveryEPSS 0.6%CVE-2025-15398MEDIUMUasoft badaso Token BadasoAuthController.php forgetPassword password recoveryEPSS 0.6%CVE-2024-22454HIGH Dell PowerProtect Data Manager, version 19.15 and prior versions, contain a weak password recovery mechanism for forgotten passwords. A remEPSS 0.6%CVE-2025-12866CRITICALHundred Plus｜EIP Plus - Weak Password Recovery MechanismEPSS 0.6%CVE-2024-5404CRITICALifm: moneo prone to weak password recovery mechanism EPSS 0.5%CVE-2025-0331MEDIUMYunzMall HTTP POST Request ResetpwdController.php changePwd password recoveryEPSS 0.5%CVE-2024-38287CRITICALThe password-reset mechanism in the Forgot Password functionality in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers EPSS 0.5%CVE-2020-12067HIGHIn Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a user's password may be changed by an attacker withouEPSS 0.5%CVE-2026-2564CRITICALIntelbras VIP 3260 Z IA OutsideCmd password recoveryEPSS 0.5%CVE-2026-93340HIGHGladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password EndpointEPSS 0.5%CVE-2026-12949CRITICALWishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' ParameterEPSS 0.5%CVE-2021-36436MEDIUMAn issue in Mobicint Backend for Credit Unions v3 allows attackers to retrieve partial email addresses and user entered information via submEPSS 0.5%