Falhas do tipo CWE-303

109 resultados

Implementação incorreta de algoritmos de autenticação

Fraqueza que ocorre quando um desenvolvedor implementa mal um algoritmo de autenticação, introduzindo falhas lógicas que permitem bypass ou acesso não autorizado. Pode envolver erros na validação de credenciais, tratamento incorreto de tokens, criptografia fraca ou fluxos de autenticação vulneráveis.

Exemplo

Um sistema verifica se a senha está correta comparando strings sem usar funções de comparação seguras (timing-safe), permitindo ataques de timing onde o atacante infere a senha byte a byte observando diferenças no tempo de resposta. Ou ainda, um JWT validado apenas na estrutura, mas sem verificar a assinatura corretamente.

Como mitigar

Use bibliotecas criptográficas estabelecidas e auditadas em vez de implementar algoritmos manualmente. Faça code review rigoroso de qualquer código de autenticação, aplique testes de segurança específicos e valide contra padrões reconhecidos (OWASP, NIST) antes de ir para produção.

CVE-2026-46389CRITICALUDS Identity Config has a client authentication bypass in `ClientIdAndKubernetesSecretAuthenticator`EPSS 0.3%CVE-2024-41829LOWIn JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connectionEPSS 0.3%CVE-2026-66028HIGHEkushey Project Manager CRM 5.0 Missing Uniqueness Constraint via Client EmailEPSS 0.3%CVE-2023-5627HIGHIncorrect Implementation of Authentication Algorithm VulnerabilityEPSS 0.3%CVE-2026-73444MEDIUMOn affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim theEPSS 0.3%CVE-2026-8922MEDIUMOrg.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-servicesEPSS 0.3%CVE-2025-44557HIGHA state machine transition flaw in the Bluetooth Low Energy (BLE) stack of Cypress PSoC4 v3.66 allows attackers to bypass the pairing procesEPSS 0.3%CVE-2025-4676HIGHAuthentication bypass by brute forcing Authentication HeadersEPSS 0.3%CVE-2025-14273HIGHMattermost Jira plugin user spoofing enables Jira request forgery.EPSS 0.3%CVE-2019-25436MEDIUMSricam DeviceViewer 3.12.0.1 Password Change Security BypassEPSS 0.3%CVE-2023-4641MEDIUMShadow-utils: possible password leak during passwd(1) changeEPSS 0.3%CVE-2024-34722HIGHIn smp_proc_rand of smp_act.cc, there is a possible authentication bypass during legacy BLE pairing due to incorrect implementation of a proEPSS 0.3%CVE-2025-8881MEDIUMInappropriate implementation in File Picker in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engagEPSS 0.2%CVE-2026-32953MEDIUMTillitis: TKey Client has an Error in Protocol ImplementationEPSS 0.2%CVE-2026-66411MEDIUMDEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker EPSS 0.2%CVE-2025-2475MEDIUMUnauthorized Bot Login Using CredentialsEPSS 0.2%CVE-2025-3230MEDIUMBypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost ServerEPSS 0.2%CVE-2025-48994MEDIUMSignXML's signature verification with HMAC is vulnerable to an algorithm confusion attackEPSS 0.2%CVE-2024-36250LOWMFA Code ReplayEPSS 0.2%CVE-2024-52586MEDIUMeLabFTW MFA bypassEPSS 0.2%