Falhas do tipo CWE-287

2.849 resultados

Autenticação Insuficiente ou Ausente

Quando um usuário ou sistema afirma ser quem diz que é, a aplicação não valida (ou valida mal) essa identidade antes de conceder acesso. Isso permite que um atacante se passe por outra pessoa sem fornecer credenciais válidas, obtendo privilégios indevidos.

Exemplo

Um sistema que aceita login apenas verificando um campo de e-mail na sessão (sem senha), ou uma API que confia em um identificador de usuário enviado no header HTTP sem validar um token assinado. Um atacante simplesmente muda o valor e acessa dados de terceiros.

Como mitigar

Implemente autenticação robusta: exija senha forte + MFA quando possível, valide tokens com assinatura criptográfica, revoque sessões expiradas, e nunca confie em dados controlados pelo cliente. Teste autenticação em cada endpoint crítico.

CVE-2026-85595CRITICALTraefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuthEPSS 2.5%CVE-2017-7420—An Authentication Bypass (CWE-287) vulnerability in ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer anEPSS 2.4%CVE-2017-11430HIGHMultiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversalEPSS 2.4%CVE-2020-3361HIGHCisco Webex Meetings and Cisco Webex Meetings Server Token Handling Unauthorized Access VulnerabilityEPSS 2.4%CVE-2026-24898CRITICALOpenEMR has an Unauthenticated MedEx Token DisclosureEPSS 2.4%CVE-2020-3125HIGHCisco Adaptive Security Appliance Software Kerberos Authentication Bypass VulnerabilityEPSS 2.4%CVE-2026-49003CRITICALUnauthenticated RCE Vulnerability in ZTE ZXDU68 S202 V5.0 ProductEPSS 2.4%CVE-2021-43786CRITICALAPI token verification can be bypassedEPSS 2.4%CVE-2024-37152MEDIUMUnauthenticated Access to sensitive settings in Argo CDEPSS 2.3%CVE-2018-1112HIGHglusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster clientEPSS 2.3%CVE-2022-41912CRITICALcrewjam/saml go library is vulnerable to signature bypass via multiple Assertion elementsEPSS 2.3%CVE-2022-24883HIGHFreeRDP Server authentication might allow invalid credentials to passEPSS 2.3%CVE-2020-7533—CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication whEPSS 2.3%CVE-2014-0769—Festo CECX-X-(C1/M1) Controller Improper AuthenticationEPSS 2.3%CVE-2026-21891CRITICALZimaOS has Authentication Bypass via System-Level UsernameEPSS 2.3%CVE-2022-31020HIGHRemote code execution in Indy's NODE_UPGRADE transactionEPSS 2.3%CVE-2017-9625—An Improper Authentication issue was discovered in Envitech EnviDAS Ultimate Versions prior to v1.0.0.5. The web application lacks proper auEPSS 2.3%CVE-2019-18314—A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network accessEPSS 2.3%CVE-2021-25315CRITICALsalt-api unauthenticated remote code executionEPSS 2.3%CVE-2017-14000—An Improper Authentication issue was discovered in Ctek SkyRouter Series 4200 and 4400, all versions prior to V6.00.11. By accessing a speciEPSS 2.3%