Falhas do tipo CWE-287

2.858 resultados

Autenticação Insuficiente ou Ausente

Quando um usuário ou sistema afirma ser quem diz que é, a aplicação não valida (ou valida mal) essa identidade antes de conceder acesso. Isso permite que um atacante se passe por outra pessoa sem fornecer credenciais válidas, obtendo privilégios indevidos.

Exemplo

Um sistema que aceita login apenas verificando um campo de e-mail na sessão (sem senha), ou uma API que confia em um identificador de usuário enviado no header HTTP sem validar um token assinado. Um atacante simplesmente muda o valor e acessa dados de terceiros.

Como mitigar

Implemente autenticação robusta: exija senha forte + MFA quando possível, valide tokens com assinatura criptográfica, revoque sessões expiradas, e nunca confie em dados controlados pelo cliente. Teste autenticação em cada endpoint crítico.

CVE-2022-45877HIGHPIN code is transmitted to the peer device in plain text during cross-device authentication, which reduces the difficulty of man-in-the-middle attacks.EPSS 0.2%CVE-2026-20891MEDIUMImproper authentication for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow an escalation ofEPSS 0.2%CVE-2026-4829MEDIUMImproper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user tEPSS 0.2%CVE-2026-71416HIGHHeadroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)EPSS 0.2%CVE-2022-43900MEDIUMIBM WebSphere Automation for IBM Cloud Pak for Watson AIOps security bypassEPSS 0.2%CVE-2022-26858MEDIUMDell BIOS versions contain an Improper Authentication vulnerability. A locally authenticated malicious user could potentially exploit this vEPSS 0.2%CVE-2026-64745LOWThis issue was addressed with additional restrictions on the lock screen. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A pEPSS 0.2%CVE-2026-49848MEDIUMFreeSWITCH: Pre-authentication `userVariables` injection in `mod_verto`EPSS 0.2%CVE-2023-31292MEDIUMAn issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows local attackers to obtain sensitive informaEPSS 0.2%CVE-2026-84312HIGHNginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)EPSS 0.2%CVE-2026-49852HIGHjoserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)EPSS 0.2%CVE-2026-18759HIGHAn improper authentication and path traversal vulnerability exists in ASUSTOR Backup Plan and ASUSTOR EZ Sync.EPSS 0.2%CVE-2026-61687HIGHhatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthStateEPSS 0.2%CVE-2026-47202CRITICALKavita: Pre-Auth Account TakeoverEPSS 0.2%CVE-2026-111261—Apache TomEE: Authentication bypass with empty password in LDAP identity storeEPSS 0.2%CVE-2026-84490LOWThis issue was addressed through improved state management. This issue is fixed in iOS 27 and iPadOS 27. An attacker with physical access toEPSS 0.2%CVE-2026-49203HIGHUnauthenticated eSIM Configuration ManipulationEPSS 0.2%CVE-2019-6854—A CWE-287: Improper Authentication vulnerability exists in a folder within EcoStruxure Geo SCADA Expert (ClearSCADA) -with initial releases EPSS 0.2%CVE-2022-37345HIGHImproper authentication in BIOS firmware[A1] for some Intel(R) NUC Kits before version RY0386 may allow an authenticated user to potentiallyEPSS 0.2%CVE-2026-111090HIGHImproper Signature Verification of Firmware Update FilesEPSS 0.2%