Falhas do tipo CWE-303

121 resultados

Implementação incorreta de algoritmos de autenticação

Fraqueza que ocorre quando um desenvolvedor implementa mal um algoritmo de autenticação, introduzindo falhas lógicas que permitem bypass ou acesso não autorizado. Pode envolver erros na validação de credenciais, tratamento incorreto de tokens, criptografia fraca ou fluxos de autenticação vulneráveis.

Exemplo

Um sistema verifica se a senha está correta comparando strings sem usar funções de comparação seguras (timing-safe), permitindo ataques de timing onde o atacante infere a senha byte a byte observando diferenças no tempo de resposta. Ou ainda, um JWT validado apenas na estrutura, mas sem verificar a assinatura corretamente.

Como mitigar

Use bibliotecas criptográficas estabelecidas e auditadas em vez de implementar algoritmos manualmente. Faça code review rigoroso de qualquer código de autenticação, aplique testes de segurança específicos e valide contra padrões reconhecidos (OWASP, NIST) antes de ir para produção.

CVE-2025-14273HIGHMattermost Jira plugin user spoofing enables Jira request forgery.EPSS 0.3%CVE-2025-8881MEDIUMInappropriate implementation in File Picker in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engagEPSS 0.3%CVE-2026-101878HIGHBitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier TruncationEPSS 0.3%CVE-2023-4641MEDIUMShadow-utils: possible password leak during passwd(1) changeEPSS 0.3%CVE-2026-32953MEDIUMTillitis: TKey Client has an Error in Protocol ImplementationEPSS 0.3%CVE-2026-86589MEDIUMApache Answer: User Center integration does not revoke first-login sessions after central account suspensionEPSS 0.3%CVE-2024-34722HIGHIn smp_proc_rand of smp_act.cc, there is a possible authentication bypass during legacy BLE pairing due to incorrect implementation of a proEPSS 0.3%CVE-2025-2475MEDIUMUnauthorized Bot Login Using CredentialsEPSS 0.2%CVE-2025-48994MEDIUMSignXML's signature verification with HMAC is vulnerable to an algorithm confusion attackEPSS 0.2%CVE-2025-3230MEDIUMBypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost ServerEPSS 0.2%CVE-2024-36250LOWMFA Code ReplayEPSS 0.2%CVE-2025-2571MEDIUMGoogle OAuth Authentication Bypass for Converted Bot AccountsEPSS 0.2%CVE-2024-52586MEDIUMeLabFTW MFA bypassEPSS 0.2%CVE-2026-0999MEDIUMAuthentication bypass via userID login when email and username login are disabledEPSS 0.2%CVE-2026-109928—Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account TakeoverEPSS 0.2%CVE-2026-96460MEDIUMKeycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v2EPSS 0.2%CVE-2026-27656MEDIUMAccount Takeover via Substring Matching in OpenID Connect AuthenticationEPSS 0.2%CVE-2026-15688CRITICALPassword Authentication Bypass Vulnerability in GX Works3 and Motion Control SettingEPSS 0.2%CVE-2026-9853HIGHA vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read aEPSS 0.1%CVE-2026-9854HIGHA vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to adminisEPSS 0.1%