Falhas do tipo CWE-640

247 resultados

Mecanismo fraco de recuperação de senha

A aplicação oferece um fluxo de recuperação de senha (esqueci minha senha) que é facilmente contornável ou previsível. Um atacante pode adivinhar perguntas de segurança, interceptar links de reset, reusar tokens, ou explorar validações fracas para assumir contas alheias sem conhecer a senha original.

Exemplo

Um site envia um link de reset de senha por e-mail, mas o token nunca expira e é simplesmente o ID do usuário codificado em base64. Um atacante pode reutilizar tokens antigos ou gerar novos para qualquer usuário, resetando suas senhas à vontade.

Como mitigar

Implemente tokens de reset com alta entropia, validade curta (15-30 min), uso único, e vinculação ao IP/sessão. Valide a identidade antes do reset (OTP, e-mail de confirmação, desafio adaptativo). Registre e monitore tentativas anormais de recuperação.

CVE-2026-16436CRITICALAn authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizVizEPSS 0.4%CVE-2025-3849MEDIUMYXJ2018 SpringBoot-Vue-OnlineExam studentPWD unverified password changeEPSS 0.4%CVE-2024-12295HIGHBoomBox Theme Extensions <= 1.8.0 - Authenticated (Subscriber+) Privilege Escalation via Password Reset/Account Takeover in boombox_ajax_reset_passwordEPSS 0.4%CVE-2023-46138LOWJumpServer default admin user email leak password resetEPSS 0.4%CVE-2026-50635HIGHLimeSurvey Password Reset Host Header Injection Discloses Reset TokenEPSS 0.4%CVE-2024-50356NONEPress has a potential 2FA bypassEPSS 0.4%CVE-2026-32103MEDIUMStudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link GenerationEPSS 0.4%CVE-2025-29995HIGHAccount Takeover Vulnerability in CAP back office applicationEPSS 0.4%CVE-2025-64101HIGHZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header InjectionEPSS 0.4%CVE-2025-50503HIGHA vulnerability in the password reset workflow of the Touch Lebanon Mobile App 2.20.2 allows an attacker to bypass the OTP reset password meEPSS 0.4%CVE-2022-42807—A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13. A user may accidentally add a participaEPSS 0.4%CVE-2025-2093LOWPHPGurukul Online Library Management System change-password.php password recoveryEPSS 0.4%CVE-2026-107640CRITICALIntegrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset APIEPSS 0.4%CVE-2026-81905MEDIUMConcrete CMS below 9.5.3 does not enforce validation-hash type on redemption, allowing a hash issued for one purpose to be redeemed for another.EPSS 0.4%CVE-2024-5277MEDIUMWeak Password Recovery Mechanism in lunary-ai/lunaryEPSS 0.4%CVE-2026-9466MEDIUMTiandy Easy7 Integrated Management Platform API Endpoint updateUserPassword password recoveryEPSS 0.4%CVE-2024-43190MEDIUMIBM Engineering Requirements Management DOORS weak authenticationEPSS 0.4%CVE-2026-36438MEDIUMAn issue in Intelbras VIP-1230-D-G4 Version V2.800.00IB00C.0.T allows a remote attacker to obtain sensitive information via password reset fEPSS 0.3%CVE-2026-82487MEDIUMBeetel 450TC3 password recoveryEPSS 0.3%CVE-2025-14783MEDIUMEasy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirectEPSS 0.3%