Falhas do tipo CWE-640

247 resultados

Mecanismo fraco de recuperação de senha

A aplicação oferece um fluxo de recuperação de senha (esqueci minha senha) que é facilmente contornável ou previsível. Um atacante pode adivinhar perguntas de segurança, interceptar links de reset, reusar tokens, ou explorar validações fracas para assumir contas alheias sem conhecer a senha original.

Exemplo

Um site envia um link de reset de senha por e-mail, mas o token nunca expira e é simplesmente o ID do usuário codificado em base64. Um atacante pode reutilizar tokens antigos ou gerar novos para qualquer usuário, resetando suas senhas à vontade.

Como mitigar

Implemente tokens de reset com alta entropia, validade curta (15-30 min), uso único, e vinculação ao IP/sessão. Valide a identidade antes do reset (OTP, e-mail de confirmação, desafio adaptativo). Registre e monitore tentativas anormais de recuperação.

CVE-2026-33707CRITICALWeak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lmsEPSS 0.4%CVE-2026-53953CRITICALGetSimple CMS: Predictable Password Reset Password Allows Administrator Account TakeoverEPSS 0.4%CVE-2024-38468CRITICALShenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized password resets via the resetPassword API.EPSS 0.4%CVE-2024-24903HIGHDell Secure Connect Gateway (SCG) Policy Manager, version 5.10+, contain a weak password recovery mechanism for forgotten passwords. An adjaEPSS 0.4%CVE-2024-45980HIGHA host header injection vulnerability in MEANStore 1.0 allows attackers to obtain the password reset token via user interaction with a craftEPSS 0.4%CVE-2026-14850HIGHWeak password recovery mechanism for forgotten password in MobiAPParcEPSS 0.4%CVE-2023-53958HIGHLDAP Tool Box Self Service Password 1.5.2 Account Takeover via HTTP Host HeaderEPSS 0.4%CVE-2025-50594CRITICALAn issue was discovered in /Code/Websites/DanpheEMR/Controllers/Settings/SecuritySettingsController.cs in Danphe Health Hospital Management EPSS 0.4%CVE-2024-9907MEDIUMQileCMS Verification Code Forget.php sendEmail password recoveryEPSS 0.4%CVE-2024-27899HIGHSecurity misconfiguration vulnerability in SAP NetWeaver AS Java User Management EngineEPSS 0.4%CVE-2025-4319CRITICALImproper Access Control in Birebirsoft's SufirmamEPSS 0.4%CVE-2026-53997CRITICALNetherman Portal del Hermano Account Takeover via Password Reset OracleEPSS 0.4%CVE-2026-6285HIGHImproper Authentication in Ankaref's LIBRID/LIBREFEPSS 0.4%CVE-2025-8855HIGH2FA Expiry Bypass in Optimus Software's Brokerage AutomationEPSS 0.4%CVE-2025-43932CRITICALJobCenter through 7e7b0b2 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depeEPSS 0.4%CVE-2025-43931CRITICALflask-boilerplate through a170e7c allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reEPSS 0.4%CVE-2024-6203HIGHHaloITSM - Password Reset PoisoningEPSS 0.4%CVE-2020-5361MEDIUMSelect Dell Client Commercial and Consumer platforms support a BIOS password reset capability that is designed to assist authorized customerEPSS 0.4%CVE-2025-62709MEDIUMClipBucket v5 is vulnerable to password reset link manipulationEPSS 0.4%CVE-2023-31459HIGHA vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthentEPSS 0.4%