Falhas do tipo CWE-640

247 resultados

Mecanismo fraco de recuperação de senha

A aplicação oferece um fluxo de recuperação de senha (esqueci minha senha) que é facilmente contornável ou previsível. Um atacante pode adivinhar perguntas de segurança, interceptar links de reset, reusar tokens, ou explorar validações fracas para assumir contas alheias sem conhecer a senha original.

Exemplo

Um site envia um link de reset de senha por e-mail, mas o token nunca expira e é simplesmente o ID do usuário codificado em base64. Um atacante pode reutilizar tokens antigos ou gerar novos para qualquer usuário, resetando suas senhas à vontade.

Como mitigar

Implemente tokens de reset com alta entropia, validade curta (15-30 min), uso único, e vinculação ao IP/sessão. Valide a identidade antes do reset (OTP, e-mail de confirmação, desafio adaptativo). Registre e monitore tentativas anormais de recuperação.

CVE-2025-14783MEDIUMEasy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirectEPSS 0.3%CVE-2026-112035MEDIUMaircheng-org iWebShop-5 simple.php send_message_mobile password recoveryEPSS 0.3%CVE-2025-32486CRITICALWordPress Material Dashboard plugin <= 1.4.6 - Privilege Escalation VulnerabilityEPSS 0.3%CVE-2026-53904MEDIUMAccount Denial of Service in MCOEPSS 0.3%CVE-2025-53373HIGHNatours has a 1 Click Account take over on reset password via Host Header injectionEPSS 0.3%CVE-2025-7881MEDIUMMercusys MW301R Web Interface password recoveryEPSS 0.3%CVE-2026-46346MEDIUMGoobi viewer: Predictable Password Reset Token Allows Unauthorized Password ResetEPSS 0.3%CVE-2026-63159CRITICALOmnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account TakeoverEPSS 0.3%CVE-2024-45670MEDIUMIBM Security SOAR weak password recovery mechanismEPSS 0.3%CVE-2025-14696MEDIUMShenzhen Sixun Software Sixun Shanghui Group Business Management System UpdatePasswordBatch password recoveryEPSS 0.3%CVE-2024-36407LOWSuiteCRM unauthenticated user password reset on php7EPSS 0.3%CVE-2026-94380HIGHHost Header Injection in HAVELSAN's Liman MYSEPSS 0.3%CVE-2026-108737HIGHTraccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose ConfusionEPSS 0.3%CVE-2026-32865CRITICALOPEXUS eComplaint and eCase insecure password resetEPSS 0.3%CVE-2025-53704HIGHMAXHUB Pivot Weak Password Recovery Mechanism for Forgotten PasswordEPSS 0.3%CVE-2026-61143MEDIUMVulnerability in the Oracle Communications Convergent Charging Controller product of Oracle Communications (component: Prov IF). Supported EPSS 0.3%CVE-2026-53646HIGHFOSSBilling: Client password reset token reuse allows persistent account takeoverEPSS 0.3%CVE-2023-29145—The Malwarebytes EDR 1.0.11 for Linux driver doesn't properly ensure whitelisting of executable libraries loaded by executable files, allowiEPSS 0.3%CVE-2026-100870HIGHSylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host HeaderEPSS 0.3%CVE-2026-34751CRITICALPayload has Unvalidated Input in Password Recovery EndpointsEPSS 0.3%