Falhas do tipo CWE-287

2.850 resultados

Autenticação Insuficiente ou Ausente

Quando um usuário ou sistema afirma ser quem diz que é, a aplicação não valida (ou valida mal) essa identidade antes de conceder acesso. Isso permite que um atacante se passe por outra pessoa sem fornecer credenciais válidas, obtendo privilégios indevidos.

Exemplo

Um sistema que aceita login apenas verificando um campo de e-mail na sessão (sem senha), ou uma API que confia em um identificador de usuário enviado no header HTTP sem validar um token assinado. Um atacante simplesmente muda o valor e acessa dados de terceiros.

Como mitigar

Implemente autenticação robusta: exija senha forte + MFA quando possível, valide tokens com assinatura criptográfica, revoque sessões expiradas, e nunca confie em dados controlados pelo cliente. Teste autenticação em cada endpoint crítico.

CVE-2021-41309MEDIUMAffected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export aEPSS 0.8%CVE-2025-4015MEDIUM20120630 Novel-Plus SessionController.java list missing authenticationEPSS 0.8%CVE-2022-32928MEDIUMA logic issue was addressed with improved restrictions. This issue is fixed in iOS 16, macOS Ventura 13, watchOS 9. A user in a privileged nEPSS 0.8%CVE-2021-26253HIGHBypass of Splunk Enterprise's implementation of DUO MFAEPSS 0.8%CVE-2022-39264HIGHnheko vulnerable to secret poisoning using MITM on secret requests by the homeserverEPSS 0.8%CVE-2023-6847HIGHImproper Authentication in GitHub Enterprise Server leading to Authentication Bypass for Public Repository DataEPSS 0.8%CVE-2024-7923CRITICALPuppet-pulpcore: an authentication bypass vulnerability exists in pulpcoreEPSS 0.8%CVE-2018-14637MEDIUMThe SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can eEPSS 0.8%CVE-2026-1203MEDIUMCRMEB JSON Token LoginServices.php remoteRegister improper authenticationEPSS 0.8%CVE-2018-16465—Missing state in Nextcloud Server prior to 14.0.0 would not enforce the use of a second factor at login if the the provider of the second faEPSS 0.8%CVE-2022-23541MEDIUMjsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMACEPSS 0.8%CVE-2019-5426—In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an unauthenticated user can use the "local port forwarding" and "dynamic port forwardingEPSS 0.8%CVE-2026-20129CRITICALCisco Catayst SD-WAN Authentication Bypass VulnerabilityEPSS 0.8%CVE-2024-11015CRITICALSign In With Google <= 1.8.0 - Authentication Bypass in authenticate_userEPSS 0.8%CVE-2025-46548MEDIUMApache Pekko Management, Apache Pekko Management, Apache Pekko Management, Akka Management, Akka Management, Akka Management: management API basic authentication is not effectiveEPSS 0.8%CVE-2024-13111MEDIUMBeijing Yunfan Internet Technology Yunfan Learning Examination System JWT Token SysUserControl improper authenticationEPSS 0.8%CVE-2022-43549CRITICALImproper authentication in Veeam Backup for Google Cloud v1.0 and v3.0 allows attackers to bypass authentication mechanisms.EPSS 0.8%CVE-2024-52786CRITICALAn authentication bypass vulnerability in anji-plus AJ-Report up to v1.4.2 allows unauthenticated attackers to execute arbitrary code via a EPSS 0.8%CVE-2022-22289MEDIUMImproper access control vulnerability in S Assistant prior to version 7.5 allows attacker to remotely get senstive information.EPSS 0.8%CVE-2022-32514CRITICALA CWE-287: Improper Authentication vulnerability exists that could allow an attacker to gain control of the device when logging into a web pEPSS 0.8%