Falhas do tipo CWE-640

247 resultados

Mecanismo fraco de recuperação de senha

A aplicação oferece um fluxo de recuperação de senha (esqueci minha senha) que é facilmente contornável ou previsível. Um atacante pode adivinhar perguntas de segurança, interceptar links de reset, reusar tokens, ou explorar validações fracas para assumir contas alheias sem conhecer a senha original.

Exemplo

Um site envia um link de reset de senha por e-mail, mas o token nunca expira e é simplesmente o ID do usuário codificado em base64. Um atacante pode reutilizar tokens antigos ou gerar novos para qualquer usuário, resetando suas senhas à vontade.

Como mitigar

Implemente tokens de reset com alta entropia, validade curta (15-30 min), uso único, e vinculação ao IP/sessão. Valide a identidade antes do reset (OTP, e-mail de confirmação, desafio adaptativo). Registre e monitore tentativas anormais de recuperação.

CVE-2026-29199HIGHphpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When force_server_vars is disabledEPSS 0.2%CVE-2026-108335CRITICALPassword Reset Functionality Missing Brute-Force ProtectionEPSS 0.2%CVE-2026-58202HIGHOpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation`EPSS 0.2%CVE-2026-19218CRITICALPassword Reset Code Brute Force Leading to Account Takeover in AKIN Software's MyRezztaEPSS 0.2%CVE-2026-105785MEDIUMJoplin Server password reset accepts tokens issued for unrelated purposesEPSS 0.2%CVE-2026-9609MEDIUMQianFox FoxCMS Admin.php edit password recoveryEPSS 0.2%CVE-2025-56748MEDIUMCreativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiEPSS 0.2%CVE-2024-32642HIGHHost header poisoning allows account takeover via password reset emailEPSS 0.2%CVE-2023-28202—This issue was addressed with improved state management. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, tvOS 16.5, macOS VentEPSS 0.2%CVE-2026-4136MEDIUMMembership Plugin – Restrict Content <= 3.2.24 - Unvalidated Redirect in Password Reset Flow via rcp_redirectEPSS 0.2%CVE-2024-12604MEDIUMImproper Authentication in Tapandsign Technologies Tap and Sign AppEPSS 0.2%CVE-2026-109204MEDIUMLogicalDOC Community Edition through 9.3 Forced Password Reset via Unbound PswRecovery TicketEPSS 0.2%CVE-2026-62486MEDIUMVulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions tEPSS 0.2%CVE-2026-60650HIGHVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions tEPSS 0.2%CVE-2026-60646HIGHVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions tEPSS 0.2%CVE-2026-60648HIGHVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions tEPSS 0.2%CVE-2023-34357HIGHSoar Cloud Ltd. HR Portal - Weak Password Recovery Mechanism for Forgotten PasswordEPSS 0.2%CVE-2025-36579MEDIUMDell Client Platform BIOS contains a Weak Password Recovery Mechanism vulnerability. An unauthenticated attacker with physical access to theEPSS 0.2%CVE-2026-46894HIGHVulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Page). Supported versions that are affecteEPSS 0.2%CVE-2026-34198MEDIUMCoolify: Password reset link poisoning via X-Forwarded-Host header spoofingEPSS 0.2%