Falhas do tipo CWE-287

2.856 resultados

Autenticação Insuficiente ou Ausente

Quando um usuário ou sistema afirma ser quem diz que é, a aplicação não valida (ou valida mal) essa identidade antes de conceder acesso. Isso permite que um atacante se passe por outra pessoa sem fornecer credenciais válidas, obtendo privilégios indevidos.

Exemplo

Um sistema que aceita login apenas verificando um campo de e-mail na sessão (sem senha), ou uma API que confia em um identificador de usuário enviado no header HTTP sem validar um token assinado. Um atacante simplesmente muda o valor e acessa dados de terceiros.

Como mitigar

Implemente autenticação robusta: exija senha forte + MFA quando possível, valide tokens com assinatura criptográfica, revoque sessões expiradas, e nunca confie em dados controlados pelo cliente. Teste autenticação em cada endpoint crítico.

CVE-2026-34736MEDIUMOpen edX Platform: Account Activation Bypass via activation_key Exposure in REST APIEPSS 0.2%CVE-2025-54154MEDIUMQNAP AuthenticatorEPSS 0.2%CVE-2026-114638HIGHTraefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name CollisionEPSS 0.2%CVE-2026-69191MEDIUMFileRise: Login Method Restriction Bypass via Direct API AccessEPSS 0.2%CVE-2021-28493HIGHIn Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, a user may be abEPSS 0.2%CVE-2026-104108HIGHFileRise OIDC login can bind an attacker identity to an existing local accountEPSS 0.2%CVE-2025-0981HIGHSession Hijacking via Stored Cross-Site Scripting (XSS) in ChurchCRM GroupEditor.php Description FieldEPSS 0.2%CVE-2026-46705MEDIUMrussh server userauth state is not reset when authentication principal changesEPSS 0.2%CVE-2026-0633LOWMetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie ValueEPSS 0.2%CVE-2026-48780HIGHForem vulnerable to bypass of email address domain restrictionsEPSS 0.2%CVE-2025-10906HIGHMagnetism Studios Endurance NSXPC com.MagnetismStudios.endurance.helper loadModuleNamed:WithReply missing authenticationEPSS 0.2%CVE-2021-25377LOWIntent redirection in Samsung Experience Service versions 10.8.0.4 in Android P(9.0) below, and 12.2.0.5 in Android Q(10.0) above allows attEPSS 0.2%CVE-2026-12112HIGHForeman-mcp-server: mcp server: active session hijacking via insecure session state reuseEPSS 0.2%CVE-2026-54510HIGHSpeakr: CSRF bypass via unauthenticated API token parameter in csrf_exempt_for_api_tokens hookEPSS 0.2%CVE-2024-22247MEDIUMVMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability. A malicious actor with physical access to the EPSS 0.2%CVE-2025-0672LOWAuthentication Bypass in Multiple WSO2 Products via Stale FIDO Credential AssociationEPSS 0.2%CVE-2026-27968MEDIUMPackistry accepts expired access tokensEPSS 0.2%CVE-2023-31189MEDIUMImproper authentication in some Intel(R) Server Product OpenBMC firmware before version egs-1.09 may allow an authenticated user to enable eEPSS 0.2%CVE-2026-101042HIGHParse Server 9.0.0 Authentication Bypass via Unverified Provider IdentityEPSS 0.2%CVE-2022-48254MEDIUMThere is a data processing error vulnerability in Leia-B29 2.0.0.49(M03). Successful exploitation could bypass lock screen authentication.EPSS 0.2%