Falhas do tipo CWE-287
2.853 resultadosAutenticação Insuficiente ou Ausente
Quando um usuário ou sistema afirma ser quem diz que é, a aplicação não valida (ou valida mal) essa identidade antes de conceder acesso. Isso permite que um atacante se passe por outra pessoa sem fornecer credenciais válidas, obtendo privilégios indevidos.
Exemplo
Um sistema que aceita login apenas verificando um campo de e-mail na sessão (sem senha), ou uma API que confia em um identificador de usuário enviado no header HTTP sem validar um token assinado. Um atacante simplesmente muda o valor e acessa dados de terceiros.
Como mitigar
Implemente autenticação robusta: exija senha forte + MFA quando possível, valide tokens com assinatura criptográfica, revoque sessões expiradas, e nunca confie em dados controlados pelo cliente. Teste autenticação em cada endpoint crítico.
CVE-2026-73963CRITICALVulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that areEPSS 0.5%CVE-2026-83099CRITICALVulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that aEPSS 0.5%CVE-2026-82995CRITICALVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). SupporEPSS 0.5%CVE-2026-46859CRITICALVulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.EPSS 0.5%CVE-2026-70757CRITICALVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected areEPSS 0.5%CVE-2026-73947CRITICALVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that EPSS 0.5%CVE-2026-61154CRITICALVulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The supported version EPSS 0.5%CVE-2026-24170HIGHNVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause impropeEPSS 0.5%CVE-2026-83061CRITICALVulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that arEPSS 0.5%CVE-2026-61065CRITICALVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that EPSS 0.5%CVE-2026-78863MEDIUMliketrek TREK Pre-2FA mfa_token authService.ts loginUser improper authenticationEPSS 0.5%CVE-2025-67158HIGHAn authentication bypass in the /cgi-bin/jvsweb.cgi endpoint of Revotech I6032W-FHW v1.0.0014 - 20210517 allows attackers to access sensitivEPSS 0.5%CVE-2026-93532MEDIUMgedelumbung HospitalManagement Password Change password.php simpan improper authenticationEPSS 0.5%CVE-2026-18216MEDIUMBackup Migration < 2.1.7 - Admin+ Privilege Escalation via Post-Restore Auto-LoginEPSS 0.5%CVE-2026-16076MEDIUMAstrBotDevs AstrBot API open_api.py OpenApiRoute.chat_send authentication spoofingEPSS 0.5%CVE-2025-14002HIGHWPCOM Member <= 1.7.16 - Authentication Bypass via Weak OTPEPSS 0.5%CVE-2026-63438CRITICAL2FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header ValueEPSS 0.5%CVE-2026-84181MEDIUMApache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject ReuseEPSS 0.5%CVE-2024-45750HIGHAn issue in TheGreenBow Windows Standard VPN Client 6.87.108 (and older), Windows Enterprise VPN Client 6.87.109 (and older), Windows EnterpEPSS 0.5%CVE-2026-57216MEDIUMRabbitMQ: AMQP 1.0, AMQP 0-9-1, Stream Protocol loopback enforcement can lead to remote guest sessions due to listener-address loopback checksEPSS 0.5%