Falhas do tipo CWE-346

698 resultados

Validação inadequada de origem (CORS/mesma origem)

A aplicação falha em validar corretamente a origem (domain/protocolo/porta) das requisições, permitindo que código malicioso de outros domínios acesse recursos protegidos. Isso quebra a política de mesma origem do navegador e pode expor dados sensíveis ou permitir ações não autorizadas.

Exemplo

Um servidor aceita qualquer valor no header Origin sem validação, ou valida de forma fraca (ex: substring matching). Um atacante hospeda um site malicioso que, ao ser visitado, faz requisições CORS para a aplicação vulnerável e consegue ler dados da vítima autenticada.

Como mitigar

Implemente validação rigorosa de origem: compare o header Origin contra uma whitelist explícita de domínios confiáveis (nunca use wildcards), valide protocolo e porta também, e desative CORS se não for necessário. Use credenciais com cautela em requisições cross-origin (credenciais + Access-Control-Allow-Origin: * é inseguro).

CVE-2026-41376LOWOpenClaw < 2026.3.31 - Matrix Thread Context Allowlist Bypass via Sender ValidationEPSS 0.2%CVE-2026-21790MEDIUMHCL Traveler is susceptible to a weak default HTTP header validation vulnerabilityEPSS 0.2%CVE-2026-75025MEDIUMMattermost Desktop local network access from server-rendered contentEPSS 0.2%CVE-2026-12032LOWInappropriate implementation in Passwords in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised EPSS 0.2%CVE-2026-55669MEDIUMZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP ProviderEPSS 0.2%CVE-2026-77363HIGHobsidian-tc Streamable HTTP transport permits cross-origin loopback vault accessEPSS 0.2%CVE-2026-102344HIGHLavish: DNS rebinding allows any website to read arbitrary local files and inject prompts into the AI agent via the unauthenticated local serverEPSS 0.2%CVE-2026-100816HIGHSite isolation issue in the DOM: Networking componentEPSS 0.2%CVE-2026-100809HIGHSame-origin policy bypass in the DevTools componentEPSS 0.2%CVE-2024-13068HIGHHost Header Injection in Akinsoft's LimonDeskEPSS 0.2%CVE-2026-11178MEDIUMInsufficient policy enforcement in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-originEPSS 0.2%CVE-2026-11226MEDIUMInsufficient policy enforcement in PreviewTab in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who convinced a uEPSS 0.2%CVE-2022-29818LOWIn JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawedEPSS 0.1%CVE-2023-28795HIGHClient IPC validation bypassEPSS 0.1%CVE-2026-11217MEDIUMInappropriate implementation in Fenced Frames in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rendEPSS 0.1%CVE-2026-47265MEDIUMAIOHTTP vulnerable to cross-origin redirect with per-request cookiesEPSS 0.1%CVE-2026-72702CRITICALGrav CMS before 2.0.16 Origin Validation Bypass via RefererEPSS 0.1%CVE-2026-109829HIGHundici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirectsEPSS 0.1%CVE-2026-11243MEDIUMInappropriate implementation in Downloads in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictionEPSS 0.1%CVE-2026-116630MEDIUMundici vulnerable to cross-user information disclosure via cross-origin redirect revalidationEPSS 0.1%