Falhas do tipo CWE-640

219 resultados

Mecanismo fraco de recuperação de senha

A aplicação oferece um fluxo de recuperação de senha (esqueci minha senha) que é facilmente contornável ou previsível. Um atacante pode adivinhar perguntas de segurança, interceptar links de reset, reusar tokens, ou explorar validações fracas para assumir contas alheias sem conhecer a senha original.

Exemplo

Um site envia um link de reset de senha por e-mail, mas o token nunca expira e é simplesmente o ID do usuário codificado em base64. Um atacante pode reutilizar tokens antigos ou gerar novos para qualquer usuário, resetando suas senhas à vontade.

Como mitigar

Implemente tokens de reset com alta entropia, validade curta (15-30 min), uso único, e vinculação ao IP/sessão. Valide a identidade antes do reset (OTP, e-mail de confirmação, desafio adaptativo). Registre e monitore tentativas anormais de recuperação.

CVE-2025-31380CRITICALWordPress Paid Videochat Turnkey Site plugin <= 7.3.11 - Broken Authentication VulnerabilityEPSS 0.6%CVE-2024-22454HIGH Dell PowerProtect Data Manager, version 19.15 and prior versions, contain a weak password recovery mechanism for forgotten passwords. A remEPSS 0.6%CVE-2025-15398MEDIUMUasoft badaso Token BadasoAuthController.php forgetPassword password recoveryEPSS 0.5%CVE-2024-5404CRITICALifm: moneo prone to weak password recovery mechanism EPSS 0.5%CVE-2024-38287CRITICALThe password-reset mechanism in the Forgot Password functionality in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers EPSS 0.5%CVE-2025-0331MEDIUMYunzMall HTTP POST Request ResetpwdController.php changePwd password recoveryEPSS 0.5%CVE-2023-44399MEDIUMZITADEL's password reset does not respect the "Ignoring unknown usernames" settingEPSS 0.5%CVE-2025-4552MEDIUMContiNew Admin password unverified password changeEPSS 0.5%CVE-2021-36436MEDIUMAn issue in Mobicint Backend for Credit Unions v3 allows attackers to retrieve partial email addresses and user entered information via submEPSS 0.5%CVE-2023-42481HIGHImproper Access Control vulnerability in SAP Commerce CloudEPSS 0.5%CVE-2025-12866CRITICALHundred Plus｜EIP Plus - Weak Password Recovery MechanismEPSS 0.5%CVE-2024-8692MEDIUMTDuckCloud TDuckPro password recoveryEPSS 0.5%CVE-2025-4320CRITICALInformation Disclosure in Birebirsoft's SufirmamEPSS 0.5%CVE-2020-12067HIGHIn Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a user's password may be changed by an attacker withouEPSS 0.5%CVE-2023-43650HIGHNon-MFA account takeover via brute-force attack on weak password reset code in jumpserverEPSS 0.5%CVE-2026-90522MEDIUMjaychouchannel Tourism-Management-System Password Recovery UsersController.java resetPass password recoveryEPSS 0.5%CVE-2025-52560HIGHKanboard Password Reset Poisoning via Host Header InjectionEPSS 0.5%CVE-2026-2564CRITICALIntelbras VIP 3260 Z IA OutsideCmd password recoveryEPSS 0.5%CVE-2026-42606HIGHAzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA BypassEPSS 0.5%CVE-2025-10322MEDIUMWavlink WL-WN578W2 sysinit.html password recoveryEPSS 0.5%