Falhas do tipo CWE-640

247 resultados

Mecanismo fraco de recuperação de senha

A aplicação oferece um fluxo de recuperação de senha (esqueci minha senha) que é facilmente contornável ou previsível. Um atacante pode adivinhar perguntas de segurança, interceptar links de reset, reusar tokens, ou explorar validações fracas para assumir contas alheias sem conhecer a senha original.

Exemplo

Um site envia um link de reset de senha por e-mail, mas o token nunca expira e é simplesmente o ID do usuário codificado em base64. Um atacante pode reutilizar tokens antigos ou gerar novos para qualquer usuário, resetando suas senhas à vontade.

Como mitigar

Implemente tokens de reset com alta entropia, validade curta (15-30 min), uso único, e vinculação ao IP/sessão. Valide a identidade antes do reset (OTP, e-mail de confirmação, desafio adaptativo). Registre e monitore tentativas anormais de recuperação.

CVE-2023-47107HIGHPILOS account takeover through password reset poisoningEPSS 0.6%CVE-2024-2463HIGHWeak password recovery mechanism in CDeXEPSS 0.6%CVE-2024-0491MEDIUMHuaxia ERP UserController.java password recoveryEPSS 0.6%CVE-2026-86260MEDIUMsfturing hosp_order Password Recovery CommonUserController.java modifyPassWord unverified password changeEPSS 0.6%CVE-2026-7459HIGHSimple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction EndpointEPSS 0.6%CVE-2026-86055HIGHPart-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account TakeoverEPSS 0.6%CVE-2025-64113CRITICALEmby Server allows attackers to gain administrative server access without preconditionsEPSS 0.6%CVE-2025-31380CRITICALWordPress Paid Videochat Turnkey Site plugin <= 7.3.11 - Broken Authentication VulnerabilityEPSS 0.6%CVE-2025-4552MEDIUMContiNew Admin password unverified password changeEPSS 0.6%CVE-2026-1325MEDIUMSangfor Operation and Maintenance Security Management System edit_pwd_mall password recoveryEPSS 0.6%CVE-2025-15398MEDIUMUasoft badaso Token BadasoAuthController.php forgetPassword password recoveryEPSS 0.6%CVE-2024-22454HIGH Dell PowerProtect Data Manager, version 19.15 and prior versions, contain a weak password recovery mechanism for forgotten passwords. A remEPSS 0.6%CVE-2025-12866CRITICALHundred Plus｜EIP Plus - Weak Password Recovery MechanismEPSS 0.6%CVE-2024-5404CRITICALifm: moneo prone to weak password recovery mechanism EPSS 0.5%CVE-2025-0331MEDIUMYunzMall HTTP POST Request ResetpwdController.php changePwd password recoveryEPSS 0.5%CVE-2024-38287CRITICALThe password-reset mechanism in the Forgot Password functionality in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers EPSS 0.5%CVE-2020-12067HIGHIn Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a user's password may be changed by an attacker withouEPSS 0.5%CVE-2026-2564CRITICALIntelbras VIP 3260 Z IA OutsideCmd password recoveryEPSS 0.5%CVE-2026-93340HIGHGladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password EndpointEPSS 0.5%CVE-2026-12949CRITICALWishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' ParameterEPSS 0.5%