Falhas do tipo CWE-287

2.850 resultados

Autenticação Insuficiente ou Ausente

Quando um usuário ou sistema afirma ser quem diz que é, a aplicação não valida (ou valida mal) essa identidade antes de conceder acesso. Isso permite que um atacante se passe por outra pessoa sem fornecer credenciais válidas, obtendo privilégios indevidos.

Exemplo

Um sistema que aceita login apenas verificando um campo de e-mail na sessão (sem senha), ou uma API que confia em um identificador de usuário enviado no header HTTP sem validar um token assinado. Um atacante simplesmente muda o valor e acessa dados de terceiros.

Como mitigar

Implemente autenticação robusta: exija senha forte + MFA quando possível, valide tokens com assinatura criptográfica, revoque sessões expiradas, e nunca confie em dados controlados pelo cliente. Teste autenticação em cada endpoint crítico.

CVE-2025-26685MEDIUMMicrosoft Defender for Identity Spoofing VulnerabilityEPSS 0.7%CVE-2025-63224CRITICALThe Itel DAB Encoder (IDEnc build 25aec8d) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers cEPSS 0.7%CVE-2023-30967CRITICALGotham Orbital Simulator path traversalEPSS 0.7%CVE-2017-20133HIGHItech Job Portal Script admin improper authenticationEPSS 0.7%CVE-2022-44569HIGHA locally authenticated attacker with low privileges can bypass authentication due to insecure inter-process communication.EPSS 0.7%CVE-2023-44397HIGHCloudExplorer Lite permission bypass vulnerabilityEPSS 0.7%CVE-2026-19806HIGHSupport Genix <= 1.4.52 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest TokenEPSS 0.7%CVE-2023-3638CRITICALGeoVision GV-ADR2701 Improper AuthenticationEPSS 0.7%CVE-2023-46942HIGHLack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive informatioEPSS 0.7%CVE-2026-40920CRITICALApache Ranger: Privilege Escalation via URL ParameterEPSS 0.7%CVE-2023-51982CRITICALCrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component. After configuring password authentication and_ LEPSS 0.7%CVE-2024-45148HIGHAdobe Commerce | Improper Authentication (CWE-287)EPSS 0.7%CVE-2026-5229CRITICALReceive Notifications After Form Submitting – Form Notify for Any Forms <= 1.1.10 - Unauthenticated Authentication Bypass via LINE OAuth CallbackEPSS 0.7%CVE-2026-94493CRITICALGigatech PDV5701 WebSocket Service index.html missing authenticationEPSS 0.7%CVE-2026-17182CRITICALIBM Db2 Mirror for i is affected by multiple vulnerabilitiesEPSS 0.7%CVE-2021-40506CRITICALAn issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. The overflow flag is not EPSS 0.7%CVE-2021-40507CRITICALAn issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. The overflow flag is not EPSS 0.7%CVE-2026-29145CRITICALApache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabledEPSS 0.7%CVE-2026-109467CRITICALAzure DevOps Server Remote Code Execution VulnerabilityEPSS 0.7%CVE-2020-5425HIGHUser Impersonation possible in Tanzu SSOEPSS 0.7%