Falhas do tipo CWE-287

2.853 resultados

Autenticação Insuficiente ou Ausente

Quando um usuário ou sistema afirma ser quem diz que é, a aplicação não valida (ou valida mal) essa identidade antes de conceder acesso. Isso permite que um atacante se passe por outra pessoa sem fornecer credenciais válidas, obtendo privilégios indevidos.

Exemplo

Um sistema que aceita login apenas verificando um campo de e-mail na sessão (sem senha), ou uma API que confia em um identificador de usuário enviado no header HTTP sem validar um token assinado. Um atacante simplesmente muda o valor e acessa dados de terceiros.

Como mitigar

Implemente autenticação robusta: exija senha forte + MFA quando possível, valide tokens com assinatura criptográfica, revoque sessões expiradas, e nunca confie em dados controlados pelo cliente. Teste autenticação em cada endpoint crítico.

CVE-2026-61641HIGHWallos: OIDC account takeover via email-based account linking without `email_verified` checkEPSS 0.5%CVE-2025-54452HIGHImproper Authentication vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 EPSS 0.5%CVE-2026-17175HIGHIBM Db2 Mirror for i is affected by multiple vulnerabilitiesEPSS 0.5%CVE-2023-25790MEDIUMWordPress WoodMart theme <= 7.0.4 - Unauth Arbitrary Shortcodes InjectionEPSS 0.5%CVE-2026-44986CRITICALPenpot: Pre-authenticated account takeover via team-invitation token + prepare-register-profileEPSS 0.5%CVE-2026-16972MEDIUMVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.5%CVE-2022-39018HIGHBroken access controls on PDFtron data in M-Files HubshareEPSS 0.5%CVE-2024-10020HIGHHeateor Social Login WordPress <= 1.1.35 - Authentication Bypass via Disqus OAuth providerEPSS 0.5%CVE-2024-47761HIGHGLPI vulnerable to account takeover via the password reset featureEPSS 0.5%CVE-2024-11917HIGHJobSearch WP Job Board <= 2.9.2 - Authentication Bypass via Social LoginsEPSS 0.5%CVE-2026-91323CRITICALVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected areEPSS 0.5%CVE-2025-52553MEDIUMauthentik has Insufficient Session verification for Remote Access Control endpoint accessEPSS 0.5%CVE-2026-83399CRITICALVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected areEPSS 0.5%CVE-2026-42210MEDIUMWebmin 2FA requirement bypassEPSS 0.5%CVE-2018-25236CRITICALHirschmann HiOS HiSecOS Authentication Bypass via HTTP ManagementEPSS 0.5%CVE-2023-26150MEDIUMVersions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space witEPSS 0.5%CVE-2025-22375CRITICALAuthentication Bypass in CyberAudit-WebEPSS 0.5%CVE-2023-25559HIGHSystem account impersonation in DataHubEPSS 0.5%CVE-2024-23637MEDIUMOctoPrint Unverified Password Change via Access Control SettingsEPSS 0.5%CVE-2026-5959HIGHGL.iNet GL-RM1/GL-RM10/GL-RM10RC/GL-RM1PE Factory Reset improper authenticationEPSS 0.5%