Falhas do tipo CWE-287

2.857 resultados

Autenticação Insuficiente ou Ausente

Quando um usuário ou sistema afirma ser quem diz que é, a aplicação não valida (ou valida mal) essa identidade antes de conceder acesso. Isso permite que um atacante se passe por outra pessoa sem fornecer credenciais válidas, obtendo privilégios indevidos.

Exemplo

Um sistema que aceita login apenas verificando um campo de e-mail na sessão (sem senha), ou uma API que confia em um identificador de usuário enviado no header HTTP sem validar um token assinado. Um atacante simplesmente muda o valor e acessa dados de terceiros.

Como mitigar

Implemente autenticação robusta: exija senha forte + MFA quando possível, valide tokens com assinatura criptográfica, revoque sessões expiradas, e nunca confie em dados controlados pelo cliente. Teste autenticação em cada endpoint crítico.

CVE-2026-103319MEDIUMOPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Confirmation Forgery via Empty Default Secret KeyEPSS 0.2%CVE-2026-103306MEDIUMiKhokha Payment Gateway < 3.0.4 - Unauthenticated Order Payment Forgery via CallbackEPSS 0.2%CVE-2026-103299MEDIUMnexi Alpha Bank for WooCommerce <= 2.2.0 - Unauthenticated Payment Confirmation Forgery via Empty Shared SecretEPSS 0.2%CVE-2026-9084MEDIUMMISP OIDC authentication bypass via automatic email-based account linking under insecure IdP configurationsEPSS 0.2%CVE-2026-81740MEDIUMPaytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment CallbackEPSS 0.2%CVE-2026-111240—Apache TomEE: Authentication bypass for accounts without a stored password in SQL login moduleEPSS 0.2%CVE-2026-94270MEDIUMDeema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass and Order Manipulation via WebhookEPSS 0.2%CVE-2022-37931HIGHA vulnerability in NetBatch-Plus software allows unauthorized access to the applicationEPSS 0.2%CVE-2022-45118MEDIUMTelephony in communication subsystem sends public events with personal data, but the permission is not set.EPSS 0.2%CVE-2023-28073HIGH Dell BIOS contains an improper authentication vulnerability. A locally authenticated malicious user may potentially exploit this vulnerabilEPSS 0.2%CVE-2026-86781MEDIUMSSL Zen < 4.7.40 - Subscriber+ TLS Private Key DisclosureEPSS 0.2%CVE-2026-112037MEDIUMdiem-project diem Google Analytics Client gapi.class.php certificate validationEPSS 0.2%CVE-2022-33862MEDIUMImproper access control mechanism in IPPEPSS 0.2%CVE-2025-22236HIGHCVE-2025-22236 salt advisoryEPSS 0.2%CVE-2025-64517MEDIUMsudo-rs doesn't record authenticating user properly in timestampEPSS 0.2%CVE-2026-102364MEDIUMmall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin APIEPSS 0.2%CVE-2026-95680HIGHIBM WebSphere Application Server is affected by an authorization bypassEPSS 0.2%CVE-2026-11717CRITICALAn authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. EPSS 0.2%CVE-2026-103332MEDIUMPayex Payment Gateway for WooCommerce <= 1.2.10 - Unauthenticated Payment Confirmation Forgery via Empty-Default Secret KeyEPSS 0.2%CVE-2026-109553HIGHGitea SSH certificate principal impersonation of other usersEPSS 0.2%