Falhas do tipo CWE-1390

118 resultados

Autenticação fraca

Fraqueza em que o mecanismo de autenticação não valida suficientemente a identidade do usuário, aceitando credenciais insuficientes, previsíveis ou sem proteção adequada. Um atacante consegue contornar a autenticação com pouco esforço, obtendo acesso não autorizado ao sistema.

Exemplo

Um app que permite login apenas com username (sem senha), ou um serviço que usa tokens de autenticação hardcoded que nunca expiram, ou ainda uma API que valida acesso só verificando se um campo numérico simples está presente na requisição.

Como mitigar

Implemente autenticação multifatorial, use hashing forte para senhas (bcrypt, Argon2), enforce expiração de tokens, valide credenciais contra armazenamento seguro sem padrões previsíveis, e aplique rate limiting em tentativas de login. Considere OAuth 2.0 ou SAML para delegação segura.

CVE-2025-59249HIGHMicrosoft Exchange Server Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2026-62895HIGHAzure Arc SQL Server Extension Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2025-47995MEDIUMAzure Machine Learning Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2026-77483HIGHSQL Server Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2025-30411CRITICALSensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (LiEPSS 0.8%CVE-2024-54092CRITICALA vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (AlEPSS 0.8%CVE-2024-34451CRITICALGhost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headeEPSS 0.8%CVE-2025-23058HIGHAuthenticated Broken Access Control Vulnerability in ClearPass Policy Manager Web-Based Management InterfaceEPSS 0.7%CVE-2026-83674HIGHActive Directory Federation Services (AD FS) Spoofing VulnerabilityEPSS 0.7%CVE-2025-7326HIGHEOL ASP.NET Core Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2024-0822HIGHOvirt: authentication bypassEPSS 0.7%CVE-2023-41862MEDIUMWordPress VS Contact Form plugin <= 14.0 - Sum Captcha Bypass vulnerabilityEPSS 0.7%CVE-2025-30412CRITICALSensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (LiEPSS 0.7%CVE-2025-12870CRITICALaEnrich｜eHRD - Authentication AbuseEPSS 0.7%CVE-2026-83511HIGHActive Directory Federation Services (AD FS) Spoofing VulnerabilityEPSS 0.7%CVE-2026-69982MEDIUMActive Directory Federation Services (AD FS) Security Feature Bypass VulnerabilityEPSS 0.6%CVE-2025-1727HIGHEnd-of-Train and Head-of-Train Remote Linking Protocol Weak AuthenticationEPSS 0.6%CVE-2026-70005MEDIUMActive Directory Federation Services (AD FS) Security Feature Bypass VulnerabilityEPSS 0.6%CVE-2026-69802HIGHNetwork Device Enrollment Service (NDES) Remote Code Execution VulnerabilityEPSS 0.6%CVE-2023-53894CRITICALphpfm 1.7.9 Authentication Bypass via Type Juggling VulnerabilityEPSS 0.6%