Falhas do tipo CWE-303

121 resultados

Implementação incorreta de algoritmos de autenticação

Fraqueza que ocorre quando um desenvolvedor implementa mal um algoritmo de autenticação, introduzindo falhas lógicas que permitem bypass ou acesso não autorizado. Pode envolver erros na validação de credenciais, tratamento incorreto de tokens, criptografia fraca ou fluxos de autenticação vulneráveis.

Exemplo

Um sistema verifica se a senha está correta comparando strings sem usar funções de comparação seguras (timing-safe), permitindo ataques de timing onde o atacante infere a senha byte a byte observando diferenças no tempo de resposta. Ou ainda, um JWT validado apenas na estrutura, mas sem verificar a assinatura corretamente.

Como mitigar

Use bibliotecas criptográficas estabelecidas e auditadas em vez de implementar algoritmos manualmente. Faça code review rigoroso de qualquer código de autenticação, aplique testes de segurança específicos e valide contra padrões reconhecidos (OWASP, NIST) antes de ir para produção.

CVE-2026-57852MEDIUMAuthentication Bypass via Null Short-Circuit in Grav CMS Scheduler Webhook Token CheckEPSS 0.7%CVE-2021-42146HIGHAn issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers allow remote attackers to reuse the same epoch nuEPSS 0.7%CVE-2024-4332CRITICALImproper Authentication in Tripwire Enterprise 9.1.0 APIsEPSS 0.6%CVE-2026-10050HIGHDigest authentication lossy encodingEPSS 0.6%CVE-2026-49467HIGHTOTP enrollment hijack: password gate skipped due to unawaited promiseEPSS 0.6%CVE-2026-66028HIGHEkushey Project Manager CRM 5.0 Missing Uniqueness Constraint via Client EmailEPSS 0.6%CVE-2026-35579HIGHCoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transportsEPSS 0.6%CVE-2026-59309CRITICALvCenter authentication-bypass vulnerabilityEPSS 0.6%CVE-2024-10127CRITICALSupport for authentication bypass condition in M-Files LDAP authenticationEPSS 0.6%CVE-2022-43635MEDIUMThis vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR940N 6_2111EPSS 0.6%CVE-2024-5658MEDIUMCraftCMS Plugin - Two-Factor Authentication - TOTP Token Stays Valid After UseEPSS 0.6%CVE-2022-4861MEDIUMIncorrect Implementation of Authentication AlgorithmEPSS 0.6%CVE-2025-63210CRITICALThe Newtec Celox UHD (models: CELOXA504, CELOXA820) running firmware version celox-21.6.13 is vulnerable to an authentication bypass. An attEPSS 0.6%CVE-2024-32879MEDIUMsocial-auth-app-django Improper Handling of Case Sensitivity vulnerabilityEPSS 0.6%CVE-2023-25957CRITICALA vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatibEPSS 0.6%CVE-2024-3046HIGHIn Eclipse Kura LogServlet component included in versions 5.0.0 to 5.4.1, a specifically crafted request to the servlet can allow an unautheEPSS 0.6%CVE-2024-35190MEDIUMAsterisk' res_pjsip_endpoint_identifier_ip: wrongly matches ALL unauthorized SIP requestsEPSS 0.6%CVE-2026-29515CRITICALMiCode FileExplorer SwiFTP Server Authentication BypassEPSS 0.6%CVE-2026-46595CRITICALInvoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/sshEPSS 0.6%CVE-2026-3869CRITICALCWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity and EPSS 0.5%