Falhas do tipo CWE-346

698 resultados

Validação inadequada de origem (CORS/mesma origem)

A aplicação falha em validar corretamente a origem (domain/protocolo/porta) das requisições, permitindo que código malicioso de outros domínios acesse recursos protegidos. Isso quebra a política de mesma origem do navegador e pode expor dados sensíveis ou permitir ações não autorizadas.

Exemplo

Um servidor aceita qualquer valor no header Origin sem validação, ou valida de forma fraca (ex: substring matching). Um atacante hospeda um site malicioso que, ao ser visitado, faz requisições CORS para a aplicação vulnerável e consegue ler dados da vítima autenticada.

Como mitigar

Implemente validação rigorosa de origem: compare o header Origin contra uma whitelist explícita de domínios confiáveis (nunca use wildcards), valide protocolo e porta também, e desative CORS se não for necessário. Use credenciais com cautela em requisições cross-origin (credenciais + Access-Control-Allow-Origin: * é inseguro).

CVE-2026-11181MEDIUMInappropriate implementation in Media Session in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policyEPSS 0.1%CVE-2026-116630MEDIUMundici vulnerable to cross-user information disclosure via cross-origin redirect revalidationEPSS 0.1%CVE-2023-23561MEDIUMStormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control: authenticated users can read sensitive information.EPSS 0.1%CVE-2026-35253MEDIUMVulnerability in the Oracle Macoron Tool product of Oracle Open Source Projects. The supported versions that is affected is v0.22.0. Easily EPSS 0.1%CVE-2026-112085HIGHwebpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgradesEPSS 0.1%CVE-2024-12973MEDIUMHost Header Injection in Akinsoft's OctoCloudEPSS 0.1%CVE-2026-10846HIGHInsufficient verification that responses belong to a queryEPSS 0.1%CVE-2025-1102MEDIUMA CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticatEPSS 0.1%CVE-2026-123271MEDIUMChatCLI before v1.215.2 Origin Validation Error via Unvalidated MCP OAuth Resource IndicatorEPSS 0.1%CVE-2026-120987HIGHWhale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment.EPSS 0.1%CVE-2026-105783HIGHJoplin Web Clipper pairing allows cross-origin theft of a permanent API tokenEPSS 0.1%CVE-2026-109286HIGHOpen WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModalEPSS 0.1%CVE-2026-46611MEDIUMGlances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding AttackEPSS 0.1%CVE-2024-54490MEDIUMThis issue was addressed by enabling hardened runtime. This issue is fixed in macOS Sequoia 15.2. A local attacker may gain access to user'sEPSS 0.1%CVE-2026-47703MEDIUMAdGuard Home: DoQ-to-UDP State Reduction and Source-Port OracleEPSS 0.1%CVE-2026-104659HIGHOrigin Validation Error in hMailServerEPSS 0.1%CVE-2026-109332LOWNetwork-AI before 5.15.2 CORS Origin Validation Error in MCP SSE TransportEPSS 0.1%CVE-2026-100821MEDIUMSite isolation issue in the Panning and Zooming componentEPSS 0.1%CVE-2026-44894HIGHNetty's Default QUIC token handler accepts any client-supplied tokenEPSS 0.1%CVE-2026-35568HIGHMCP Java-SDK has a DNS Rebinding VulnerabilityEPSS 0.1%