Falhas do tipo CWE-287

2.450 resultados

Autenticação Insuficiente ou Ausente

Quando um usuário ou sistema afirma ser quem diz que é, a aplicação não valida (ou valida mal) essa identidade antes de conceder acesso. Isso permite que um atacante se passe por outra pessoa sem fornecer credenciais válidas, obtendo privilégios indevidos.

Exemplo

Um sistema que aceita login apenas verificando um campo de e-mail na sessão (sem senha), ou uma API que confia em um identificador de usuário enviado no header HTTP sem validar um token assinado. Um atacante simplesmente muda o valor e acessa dados de terceiros.

Como mitigar

Implemente autenticação robusta: exija senha forte + MFA quando possível, valide tokens com assinatura criptográfica, revoque sessões expiradas, e nunca confie em dados controlados pelo cliente. Teste autenticação em cada endpoint crítico.

CVE-2026-66908HIGHApache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was acceptedEPSS 0.6%CVE-2023-49791MEDIUMWorkflows do not require password confirmation on API levelEPSS 0.6%CVE-2023-51717CRITICALDataiku DSS before 11.4.5 and 12.4.1 has Incorrect Access Control that could lead to a full authentication bypass.EPSS 0.6%CVE-2023-32202MEDIUMWalchem Intuition Improper AuthenticationEPSS 0.6%CVE-2025-24895CRITICALSAML Response Signature Verification Bypass in CIE.AspNetCore.AuthenticationEPSS 0.6%CVE-2023-22650HIGHRancher does not automatically clean up a user deleted or disabled from the configured Authentication ProviderEPSS 0.6%CVE-2019-15617—A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login.EPSS 0.6%CVE-2025-9064HIGHRockwell Automation FactoryTalk View Machine Edition Path TraversalEPSS 0.6%CVE-2025-24894CRITICALSAML Response Signature Verification Bypass in SPID.AspNetCore.AuthenticationEPSS 0.6%CVE-2025-22146CRITICALImproper authentication on SAML SSO process allows user impersonation in sentryEPSS 0.6%CVE-2026-9695CRITICALImproper Authentication vulnerability affecting DELMIA Apriso from Release 2020 through Release 2026EPSS 0.6%CVE-2026-76673CRITICALAuthentication Bypass Vulnerabilities in API of EdgeConnect SD-WAN OrchestratorEPSS 0.6%CVE-2026-33322CRITICALMinIO: JWT Algorithm Confusion in OIDC AuthenticationEPSS 0.6%CVE-2026-30831HIGHRocket.Chat: 2FA bypass and login of deactivated users via EE ddp-streamerEPSS 0.6%CVE-2025-5906MEDIUMcode-projects Laundry System data missing authenticationEPSS 0.6%CVE-2026-92792HIGHOpenNHP through 1.0.2 Authentication Bypass via Fallback VerifierEPSS 0.6%CVE-2023-3597MEDIUMKeycloak: secondary factor bypass in step-up authenticationEPSS 0.6%CVE-2022-26845HIGHImproper authentication in firmware for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allEPSS 0.6%CVE-2026-34500MEDIUMApache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabledEPSS 0.6%CVE-2024-45113HIGHColdFusion | Improper Authentication (CWE-287)EPSS 0.6%