Falhas do tipo CWE-346

697 resultados

Validação inadequada de origem (CORS/mesma origem)

A aplicação falha em validar corretamente a origem (domain/protocolo/porta) das requisições, permitindo que código malicioso de outros domínios acesse recursos protegidos. Isso quebra a política de mesma origem do navegador e pode expor dados sensíveis ou permitir ações não autorizadas.

Exemplo

Um servidor aceita qualquer valor no header Origin sem validação, ou valida de forma fraca (ex: substring matching). Um atacante hospeda um site malicioso que, ao ser visitado, faz requisições CORS para a aplicação vulnerável e consegue ler dados da vítima autenticada.

Como mitigar

Implemente validação rigorosa de origem: compare o header Origin contra uma whitelist explícita de domínios confiáveis (nunca use wildcards), valide protocolo e porta também, e desative CORS se não for necessário. Use credenciais com cautela em requisições cross-origin (credenciais + Access-Control-Allow-Origin: * é inseguro).

CVE-2026-66322HIGHMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.2%CVE-2026-57112HIGHPraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered toolsEPSS 0.2%CVE-2026-81092HIGHmcp-go before 0.56.0 Missing Host Header Validation Enables DNS RebindingEPSS 0.2%CVE-2026-6508CRITICALRCE in TUBITAK BILGEM's LiderahenkEPSS 0.2%CVE-2026-48063CRITICALBaileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payloadEPSS 0.2%CVE-2026-17916HIGHInsufficient policy enforcement in Settings in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderEPSS 0.2%CVE-2025-63388CRITICALA Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. ThEPSS 0.2%CVE-2026-55438MEDIUMCoder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofingEPSS 0.2%CVE-2026-114456MEDIUMMissing origin validation for the externalbrowser authenticator callback in multiple Snowflake client driversEPSS 0.2%CVE-2026-112101MEDIUMBlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validationEPSS 0.2%CVE-2025-7659HIGHOrigin Validation Error in GitLabEPSS 0.2%CVE-2026-58266MEDIUMAnki: User scripts in iframes have access to the internal Anki APIEPSS 0.2%CVE-2026-11020MEDIUMInappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via aEPSS 0.2%CVE-2026-67448MEDIUMMailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)EPSS 0.2%CVE-2025-10193HIGHNeo4j Cypher MCP server is vulnerable to DNS rebinding attacksEPSS 0.2%CVE-2026-66420HIGHMeshCentral Cross-Site WebSocket Hijacking via Origin Validation Bypass on Self-Signed Certificate DeploymentsEPSS 0.2%CVE-2026-107804MEDIUMNginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockoutEPSS 0.2%CVE-2026-1997MEDIUMCertain HP OfficeJet Pro Printers - Information DisclosureEPSS 0.2%CVE-2026-17977MEDIUMPolicy bypass in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (CEPSS 0.2%CVE-2026-11624CRITICALThe Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNEPSS 0.2%