Falhas do tipo CWE-287

2.850 resultados

Autenticação Insuficiente ou Ausente

Quando um usuário ou sistema afirma ser quem diz que é, a aplicação não valida (ou valida mal) essa identidade antes de conceder acesso. Isso permite que um atacante se passe por outra pessoa sem fornecer credenciais válidas, obtendo privilégios indevidos.

Exemplo

Um sistema que aceita login apenas verificando um campo de e-mail na sessão (sem senha), ou uma API que confia em um identificador de usuário enviado no header HTTP sem validar um token assinado. Um atacante simplesmente muda o valor e acessa dados de terceiros.

Como mitigar

Implemente autenticação robusta: exija senha forte + MFA quando possível, valide tokens com assinatura criptográfica, revoque sessões expiradas, e nunca confie em dados controlados pelo cliente. Teste autenticação em cada endpoint crítico.

CVE-2023-46630HIGHWordPress Admin and Site Enhancements (ASE) plugin <= 5.7.1 - Password Protected View Bypass Vulnerability vulnerabilityEPSS 0.5%CVE-2023-4242MEDIUMFULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Information Disclosure via Health CheckEPSS 0.5%CVE-2025-47275CRITICALBrute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDKEPSS 0.5%CVE-2026-5795HIGHIn Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning froEPSS 0.5%CVE-2026-82107CRITICALDataStage on Cloud Pak for Data has several vulnerabilities due to open source softwareEPSS 0.5%CVE-2026-4562MEDIUMMacCMS Timming API Endpoint Timming.php weak authenticationEPSS 0.5%CVE-2023-36724MEDIUMWindows Power Management Service Information Disclosure VulnerabilityEPSS 0.5%CVE-2024-52518MEDIUMNextcloud Server is missing password confirmation when changing external storage optionsEPSS 0.5%CVE-2026-18891HIGHLangflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilitiesEPSS 0.5%CVE-2025-15586CRITICALOGP-Website installs prior git commit 52f865a4fba763594453068acf8fa9e3fc38d663 are affected by a type juggling flaw which if exploited can rEPSS 0.5%CVE-2024-57432HIGHmacrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys are hardcoded and do not change. User inforEPSS 0.5%CVE-2026-114439MEDIUMoretnom23 php-travel-agency-system Session session.php missing authenticationEPSS 0.5%CVE-2026-101484CRITICALVulnerability in Oracle Secure Backup (component: Backup and Restore). Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0EPSS 0.5%CVE-2021-4197—An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users haveEPSS 0.5%CVE-2025-37107HIGHAn authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18.EPSS 0.5%CVE-2026-108157CRITICALPingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email LinkingEPSS 0.5%CVE-2026-80097HIGHMicrosoft Authenticator Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-59151CRITICALProwler: SAML Domain Claiming Enables Cross-Tenant Account TakeoverEPSS 0.5%CVE-2026-22236CRITICALImproper Authentication Vulnerability in BLUVOYIXEPSS 0.5%CVE-2026-111911CRITICALphpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential InjectionEPSS 0.5%