Falhas do tipo CWE-640

245 resultados

Mecanismo fraco de recuperação de senha

A aplicação oferece um fluxo de recuperação de senha (esqueci minha senha) que é facilmente contornável ou previsível. Um atacante pode adivinhar perguntas de segurança, interceptar links de reset, reusar tokens, ou explorar validações fracas para assumir contas alheias sem conhecer a senha original.

Exemplo

Um site envia um link de reset de senha por e-mail, mas o token nunca expira e é simplesmente o ID do usuário codificado em base64. Um atacante pode reutilizar tokens antigos ou gerar novos para qualquer usuário, resetando suas senhas à vontade.

Como mitigar

Implemente tokens de reset com alta entropia, validade curta (15-30 min), uso único, e vinculação ao IP/sessão. Valide a identidade antes do reset (OTP, e-mail de confirmação, desafio adaptativo). Registre e monitore tentativas anormais de recuperação.

CVE-2026-45013HIGHApostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input ValidationEPSS 0.3%CVE-2026-35676HIGHphpMyFAQ - Unauthenticated Password Reset via User Password Update EndpointEPSS 0.3%CVE-2026-61049HIGHVulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations). Supported versions tEPSS 0.3%CVE-2025-63314CRITICALA static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset theEPSS 0.3%CVE-2025-53704HIGHMAXHUB Pivot Weak Password Recovery Mechanism for Forgotten PasswordEPSS 0.3%CVE-2026-64635MEDIUMImproper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attEPSS 0.3%CVE-2026-12066MEDIUMPbootCMS Password MemberController.php retrieve password recoveryEPSS 0.3%CVE-2026-10169MEDIUMOUSL-GROUP-BrinaryBrains School Student Management System Forgot Password Endpoint Login.php ajax_forgot_password password recoveryEPSS 0.3%CVE-2021-29038MEDIUMLiferay Portal 7.2.0 through 7.3.5, and older unsupported versions, and Liferay DXP 7.3 before fix pack 1, 7.2 before fix pack 17, and olderEPSS 0.3%CVE-2026-108337HIGHPassword Reset Code Accessible in User Listing APIEPSS 0.3%CVE-2026-115973MEDIUMFaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recoveryEPSS 0.3%CVE-2026-119127HIGHZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header InjectionEPSS 0.3%CVE-2026-61181HIGHVulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality ManageEPSS 0.3%CVE-2020-37158HIGHAVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)EPSS 0.3%CVE-2026-40585HIGHblueprintUE: Password Reset Tokens Have No Expiry WindowEPSS 0.3%CVE-2026-30459HIGHAn issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset tokeEPSS 0.3%CVE-2026-34408CRITICALAn issue was discovered in Gambio 4.9.2.0 (patched in 2024-02 v1.0.0 for GX4 v4.0.0.0 to v4.9.2.0). The password reset function can be bypasEPSS 0.3%CVE-2026-22723MEDIUMUAA User Token Revocation logic errorEPSS 0.3%CVE-2026-46347MEDIUMGoobi viewer: Predictable Replacement Password Allows Account Takeover After Password ResetEPSS 0.3%CVE-2026-29199HIGHphpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When force_server_vars is disabledEPSS 0.2%