Falhas do tipo CWE-346

588 resultados

Validação inadequada de origem (CORS/mesma origem)

A aplicação falha em validar corretamente a origem (domain/protocolo/porta) das requisições, permitindo que código malicioso de outros domínios acesse recursos protegidos. Isso quebra a política de mesma origem do navegador e pode expor dados sensíveis ou permitir ações não autorizadas.

Exemplo

Um servidor aceita qualquer valor no header Origin sem validação, ou valida de forma fraca (ex: substring matching). Um atacante hospeda um site malicioso que, ao ser visitado, faz requisições CORS para a aplicação vulnerável e consegue ler dados da vítima autenticada.

Como mitigar

Implemente validação rigorosa de origem: compare o header Origin contra uma whitelist explícita de domínios confiáveis (nunca use wildcards), valide protocolo e porta também, e desative CORS se não for necessário. Use credenciais com cautela em requisições cross-origin (credenciais + Access-Control-Allow-Origin: * é inseguro).

CVE-2026-11020MEDIUMInappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via aEPSS 0.2%CVE-2026-92701CRITICALCocos AI: Intra-handshake attested TLS implementation is vulnerable to session-misbinding attacks for Intel TDX verifier pathEPSS 0.2%CVE-2026-58266MEDIUMAnki: User scripts in iframes have access to the internal Anki APIEPSS 0.2%CVE-2026-11624CRITICALThe Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNEPSS 0.2%CVE-2023-29756MEDIUMAn issue found in Twilight v.13.3 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreEPSS 0.2%CVE-2026-44649CRITICALSillyTavern: Authentication Bypass via SSO Header InjectionEPSS 0.2%CVE-2025-51605HIGHAn issue was discovered in Shopizer 3.2.7. The server's CORS implementation reflects the client-supplied Origin header verbatim into Access-EPSS 0.2%CVE-2026-16358CRITICALSite isolation issue in the Graphics: WebRender componentEPSS 0.2%CVE-2026-16349CRITICALSame-origin policy bypass in the DOM: Navigation componentEPSS 0.2%CVE-2026-17879MEDIUMInappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a cEPSS 0.2%CVE-2026-77339MEDIUMProcess Compose: Browser DNS rebinding lets websites control local process-compose MCP toolsEPSS 0.2%CVE-2026-59723HIGHCline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)EPSS 0.2%CVE-2026-17880MEDIUMInappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a cEPSS 0.2%CVE-2025-9636HIGHCross-Origin Opener Policy Vulnerability in pgAdmin 4EPSS 0.2%CVE-2026-34928HIGHAn origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. EPSS 0.2%CVE-2026-45207HIGHAn origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. EPSS 0.2%CVE-2026-45206HIGHAn origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. EPSS 0.2%CVE-2026-14053MEDIUMInsufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendEPSS 0.2%CVE-2026-19418HIGHTYPO3 CMS - Broken Access Control in Backend and Install ToolEPSS 0.2%CVE-2026-42559HIGHRMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transportEPSS 0.2%