Falhas do tipo CWE-287

2.850 resultados

Autenticação Insuficiente ou Ausente

Quando um usuário ou sistema afirma ser quem diz que é, a aplicação não valida (ou valida mal) essa identidade antes de conceder acesso. Isso permite que um atacante se passe por outra pessoa sem fornecer credenciais válidas, obtendo privilégios indevidos.

Exemplo

Um sistema que aceita login apenas verificando um campo de e-mail na sessão (sem senha), ou uma API que confia em um identificador de usuário enviado no header HTTP sem validar um token assinado. Um atacante simplesmente muda o valor e acessa dados de terceiros.

Como mitigar

Implemente autenticação robusta: exija senha forte + MFA quando possível, valide tokens com assinatura criptográfica, revoque sessões expiradas, e nunca confie em dados controlados pelo cliente. Teste autenticação em cada endpoint crítico.

CVE-2023-22334MEDIUMUse of password hash instead of password for authentication vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remotEPSS 0.9%CVE-2023-20214CRITICALA vulnerability in the request authentication validation for the REST API of Cisco SD-WAN vManage software could allow an unauthenticated, rEPSS 0.9%CVE-2023-34388MEDIUMImproper authentication could lead to session hijackingEPSS 0.9%CVE-2026-75816CRITICALFrontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object IdentifierEPSS 0.9%CVE-2024-46434HIGHTenda W18E V16.01.0.8(1625) suffers from authentication bypass in the web management portal allowing an unauthorized remote attacker to gainEPSS 0.9%CVE-2022-46170HIGHCodeIgniter is vulnerable to improper authentication via Session HandlersEPSS 0.9%CVE-2023-5970—Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external dEPSS 0.9%CVE-2024-34103HIGHCustomer account takeover via web API call & subsequent password resetEPSS 0.9%CVE-2018-0247—A vulnerability in Web Authentication (WebAuth) clients for the Cisco Wireless LAN Controller (WLC) and Aironet Access Points running Cisco EPSS 0.9%CVE-2024-39340HIGHThe authentication system of Securepoint UTM mishandles OTP keys. This allows the bypassing of second-factor verification (when OTP is enablEPSS 0.9%CVE-2023-41956HIGHWordPress Simple Membership plugin <= 4.3.4 - Authenticated Account Takeover vulnerabilityEPSS 0.9%CVE-2023-37283HIGHAuthentication Bypass via HTML Form & Identifier First AdapterEPSS 0.9%CVE-2024-21632HIGHomniauth-microsoft_graph vulnerable to account takeover (nOAuth)EPSS 0.9%CVE-2025-48370LOWauth-js Vulnerable to Insecure Path Routing from Malformed User InputEPSS 0.9%CVE-2021-29487HIGHAuthentication bypass in OctobercmsEPSS 0.9%CVE-2022-31083HIGHAuthentication bypass in Parse Server Apple Game Center auth adapter EPSS 0.9%CVE-2026-56191CRITICALMicrosoft Exchange Online Tampering VulnerabilityEPSS 0.9%CVE-2026-56162CRITICALAzure SQL Database Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2026-45480CRITICALAzure Active Directory Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2025-27641CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.951 Application 20.0.2368 allows Unauthenticated APIs for Single-SigEPSS 0.9%