Falhas do tipo CWE-287

2.850 resultados

Autenticação Insuficiente ou Ausente

Quando um usuário ou sistema afirma ser quem diz que é, a aplicação não valida (ou valida mal) essa identidade antes de conceder acesso. Isso permite que um atacante se passe por outra pessoa sem fornecer credenciais válidas, obtendo privilégios indevidos.

Exemplo

Um sistema que aceita login apenas verificando um campo de e-mail na sessão (sem senha), ou uma API que confia em um identificador de usuário enviado no header HTTP sem validar um token assinado. Um atacante simplesmente muda o valor e acessa dados de terceiros.

Como mitigar

Implemente autenticação robusta: exija senha forte + MFA quando possível, valide tokens com assinatura criptográfica, revoque sessões expiradas, e nunca confie em dados controlados pelo cliente. Teste autenticação em cada endpoint crítico.

CVE-2026-58663CRITICALApache IoTDB: Auth Bypass in pipeTransfer() interfaceEPSS 0.6%CVE-2026-18922CRITICAL389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary propertyEPSS 0.6%CVE-2023-48703HIGHSAML authentication bypass vulnerability in RobotsAndPencils/go-samlEPSS 0.6%CVE-2023-51471HIGHWordPress Checkout Mestres WP plugin <= 7.1.9.7 - Unauthenticated Arbitrary Options Update vulnerabilityEPSS 0.6%CVE-2026-3224CRITICALAuthentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unautEPSS 0.6%CVE-2026-12598HIGHLoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email in Spotify OAuth CallbackEPSS 0.6%CVE-2026-12595HIGHLoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via Discord OAuth CallbackEPSS 0.6%CVE-2026-105034HIGHEnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial NumbersEPSS 0.6%CVE-2025-6533MEDIUMxxyopen/201206030 novel-plus CATCHA LoginController.java ajaxLogin authentication replayEPSS 0.6%CVE-2026-20317CRITICALCisco Secure Workload Software Security Hardening Release August 2026 - Improper Authentication VulnerabilitiesEPSS 0.6%CVE-2022-0985—Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary mEPSS 0.6%CVE-2025-15581MEDIUMOrthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation. EPSS 0.6%CVE-2023-48865MEDIUMAn issue discovered in Reportico Till 8.1.0 allows attackers to obtain sensitive information via execute_mode parameter of the URL.EPSS 0.6%CVE-2026-48830CRITICALApache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requestsEPSS 0.6%CVE-2026-72533HIGHPortainer Portainer CE - Authentication BypassEPSS 0.6%CVE-2024-56336CRITICALA vulnerability has been identified in SINAMICS S200 (All versions with serial number beginning with SZVS8, SZVS9, SZVS0 or SZVSN and the FSEPSS 0.6%CVE-2026-97864MEDIUMGibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authenticationEPSS 0.6%CVE-2026-14627MEDIUMNousResearch hermes-agent Discord Platform Integration discord.py DiscordAdapter._is_allowed_user improper authenticationEPSS 0.6%CVE-2026-114260MEDIUMoretnom23 file-management-system-php AJAX ajax.php delete_folder missing authenticationEPSS 0.6%CVE-2026-47426HIGHOpenAM OAuth Client Impersonation via JWKS Resolver CacheEPSS 0.6%