Falhas do tipo CWE-287

2.857 resultados

Autenticação Insuficiente ou Ausente

Quando um usuário ou sistema afirma ser quem diz que é, a aplicação não valida (ou valida mal) essa identidade antes de conceder acesso. Isso permite que um atacante se passe por outra pessoa sem fornecer credenciais válidas, obtendo privilégios indevidos.

Exemplo

Um sistema que aceita login apenas verificando um campo de e-mail na sessão (sem senha), ou uma API que confia em um identificador de usuário enviado no header HTTP sem validar um token assinado. Um atacante simplesmente muda o valor e acessa dados de terceiros.

Como mitigar

Implemente autenticação robusta: exija senha forte + MFA quando possível, valide tokens com assinatura criptográfica, revoque sessões expiradas, e nunca confie em dados controlados pelo cliente. Teste autenticação em cada endpoint crítico.

CVE-2026-21134MEDIUMImproper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information.EPSS 0.2%CVE-2026-82843CRITICALWP OAuth Server < 6.4.0 - Subscriber+ Cross-User Account Takeover via OIDC ID Token SubstitutionEPSS 0.2%CVE-2022-30749LOWImproper access control vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to add arbitrary smart devices by bypassing EPSS 0.2%CVE-2022-42488HIGHStartup subsystem missed permission validation in param service. An malicious application installed on the device could elevate its privileges to the root user, disable security features, or cause DoS by disabling particular services.EPSS 0.2%CVE-2026-56837HIGHPraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missingEPSS 0.2%CVE-2023-28377MEDIUMImproper authentication in some Intel(R) NUC Kit NUC11PH USB firmware installation software before version 1.1 for Windows may allow an authEPSS 0.2%CVE-2026-4587MEDIUMHybridAuth SSL Curl.php certificate validationEPSS 0.2%CVE-2023-0035MEDIUMsoftbus_client_stub in communication subsystem has an authentication bypass vulnerability which allows an "SA relay attack".EPSS 0.2%CVE-2026-119572HIGHTraefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX ProviderEPSS 0.2%CVE-2023-0036MEDIUMplatform_callback_stub in misc subsystem has an authentication bypass vulnerability which allows an "SA relay attack".EPSS 0.2%CVE-2026-55626HIGHxrdp: No authentication required with Xvnc backend on RHEL 9EPSS 0.2%CVE-2026-12504HIGHLoytec LINX firmware: Improper Authentication in PAM configurationEPSS 0.2%CVE-2026-109873MEDIUMUser Registration & Membership < 5.3.2 - Unauthenticated Payment Before Login Bypass via Omitted Membership FieldEPSS 0.2%CVE-2026-112106MEDIUMTufayelLUS TikTok-Video-Downloader-PHP TLS index.php certificate validationEPSS 0.2%CVE-2025-41459HIGHInsecure authentication due to missing bruteforce protection and runtime manipulation in Two App Studio Journey 5.5.6 for iOSEPSS 0.2%CVE-2026-11718CRITICALAn authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. EPSS 0.2%CVE-2026-63398HIGHCoop has SAML cross-tenant authentication bypassEPSS 0.2%CVE-2026-48117MEDIUMDroneAware's Improper Account Activation in Registration and SSO Flows Leads to Account TakeoverEPSS 0.2%CVE-2022-2752MEDIUMPotential vulnerabilities in GM login processEPSS 0.2%CVE-2026-103319MEDIUMOPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Confirmation Forgery via Empty Default Secret KeyEPSS 0.2%