Fallos del tipo CWE-640

248 resultados

Mecanismo fraco de recuperação de senha

A aplicação usa um processo de recuperação de senha insuficientemente seguro, permitindo que um atacante redefina a senha de outro usuário sem autenticação adequada. Isso acontece quando perguntas de segurança são previsíveis, tokens de recuperação não expiram, ou a validação de identidade é inadequada — abrindo caminho para takeover de conta.

Ejemplo

Um banco que envia um link de reset com token válido por 30 dias, ou um e-commerce que valida recuperação apenas perguntando a data de nascimento do cadastro (informação frequentemente pública). Um atacante consegue acessar contas alheias explorando essas fraquezas.

Cómo mitigar

Use tokens criptograficamente fortes e com expiração curta (15-60 min), exija confirmação em múltiplos canais (SMS + email), implemente rate limiting para tentativas de reset, e evite perguntas de segurança previsíveis ou públicas. Valide a identidade com dados realmente privados ou biometria quando possível.

CVE-2026-15479MEDIUMH3C NX15 Administrator Password Modification Endpoint modify change_passwd password recoveryEPSS 0.5%CVE-2026-7655HIGHSureCart <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated WebhookEPSS 0.5%CVE-2023-35134HIGHWeintek Weincloud Weak Password Recovery Mechanism for Forgotten PasswordEPSS 0.5%CVE-2026-13020HIGHWeak Password Recovery Mechanism in Portal for ArcGISEPSS 0.5%CVE-2025-50433CRITICALAn issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted password reset to takEPSS 0.5%CVE-2024-6125HIGHLogin with phone number <= 1.7.34 - Insecure Password Reset MechanismEPSS 0.5%CVE-2026-116214CRITICALMacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery CodeEPSS 0.5%CVE-2026-2895MEDIUMfunadmin Member.php repass password recoveryEPSS 0.5%CVE-2026-43845CRITICALA vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.EPSS 0.5%CVE-2026-93453HIGHSOGo before 5.12.11 Password Reset Token Interception via Origin HeaderEPSS 0.5%CVE-2026-72772HIGHn8n before 2.32.1 Authentication Bypass via Token ExchangeEPSS 0.4%CVE-2025-1570HIGHDirectorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTPEPSS 0.4%CVE-2026-19361MEDIUMmacrozheng mall mall-portal getAuthCode password recoveryEPSS 0.4%CVE-2025-69614CRITICALIncorrect Access Control via activation token reuse on the password-reset endpoint allowing unauthorized password resets and full account taEPSS 0.4%CVE-2023-31287HIGHAn issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. Password reset links are sent by email. A link contains a token thEPSS 0.4%CVE-2026-101188MEDIUMNetcore POWER13 ubus routerd.passwd_set password recoveryEPSS 0.4%CVE-2025-7948MEDIUMjshERP updatePwd password recoveryEPSS 0.4%CVE-2026-33707CRITICALWeak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lmsEPSS 0.4%CVE-2026-56081CRITICALCap-go - Account Lockout via 2FA Misconfiguration on Unverified EmailEPSS 0.4%CVE-2024-42915HIGHA host header injection vulnerability in Staff Appraisal System v1.0 allows attackers to obtain the password reset token via user interactioEPSS 0.4%