Falhas do tipo CWE-287

2.850 resultados

Autenticação Insuficiente ou Ausente

Quando um usuário ou sistema afirma ser quem diz que é, a aplicação não valida (ou valida mal) essa identidade antes de conceder acesso. Isso permite que um atacante se passe por outra pessoa sem fornecer credenciais válidas, obtendo privilégios indevidos.

Exemplo

Um sistema que aceita login apenas verificando um campo de e-mail na sessão (sem senha), ou uma API que confia em um identificador de usuário enviado no header HTTP sem validar um token assinado. Um atacante simplesmente muda o valor e acessa dados de terceiros.

Como mitigar

Implemente autenticação robusta: exija senha forte + MFA quando possível, valide tokens com assinatura criptográfica, revoque sessões expiradas, e nunca confie em dados controlados pelo cliente. Teste autenticação em cada endpoint crítico.

CVE-2022-39360MEDIUMMetabase SSO users able to circumvent IdP login by doing password resetEPSS 0.6%CVE-2026-55076HIGHCoder's OIDC email_verified type coercion bypass enables account takeover via unverified email linkingEPSS 0.6%CVE-2025-22228HIGHCVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password lengthEPSS 0.6%CVE-2026-51584CRITICALAn issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in serEPSS 0.6%CVE-2026-66908HIGHApache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was acceptedEPSS 0.6%CVE-2022-29237MEDIUMLimited Authentication Bypass for Media Files in OpencastEPSS 0.6%CVE-2023-49791MEDIUMWorkflows do not require password confirmation on API levelEPSS 0.6%CVE-2026-5570MEDIUMTechnostrobe HI-LED-WR120-G2 LoginCB index_config improper authenticationEPSS 0.6%CVE-2023-32202MEDIUMWalchem Intuition Improper AuthenticationEPSS 0.6%CVE-2023-51717CRITICALDataiku DSS before 11.4.5 and 12.4.1 has Incorrect Access Control that could lead to a full authentication bypass.EPSS 0.6%CVE-2025-24895CRITICALSAML Response Signature Verification Bypass in CIE.AspNetCore.AuthenticationEPSS 0.6%CVE-2019-15617—A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login.EPSS 0.6%CVE-2023-22650HIGHRancher does not automatically clean up a user deleted or disabled from the configured Authentication ProviderEPSS 0.6%CVE-2025-24894CRITICALSAML Response Signature Verification Bypass in SPID.AspNetCore.AuthenticationEPSS 0.6%CVE-2026-9695CRITICALImproper Authentication vulnerability affecting DELMIA Apriso from Release 2020 through Release 2026EPSS 0.6%CVE-2026-76673CRITICALAuthentication Bypass Vulnerabilities in API of EdgeConnect SD-WAN OrchestratorEPSS 0.6%CVE-2025-52395CRITICALAn issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the application exposing a password reset API endpoint tEPSS 0.6%CVE-2025-5985MEDIUMcode-projects School Fees Payment System improper authenticationEPSS 0.6%CVE-2026-92792HIGHOpenNHP through 1.0.2 Authentication Bypass via Fallback VerifierEPSS 0.6%CVE-2026-53709CRITICALMCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgeryEPSS 0.6%