Weaknesses of type CWE-325

59 results

Etapa Criptográfica Obrigatória Faltando

Ocorre quando o código implementa um protocolo ou mecanismo de segurança, mas omite uma etapa criptográfica essencial do fluxo—como não assinar um dado antes de enviar, não verificar uma assinatura recebida, ou pular a validação de um certificado. Sem essa etapa, a segurança esperada desaba: um atacante pode forjar, modificar ou interceptar dados sem ser detectado.

Example

Um serviço autenticado que valida o token JWT mas esquece de verificar a assinatura dele, acreditando apenas no conteúdo do payload. Um atacante cria seu próprio token com qualquer permissão e ganha acesso total.

How to mitigate

Implemente o protocolo criptográfico completo, seguindo um padrão estabelecido (OAuth 2.0, TLS com validação de certificado, etc.). Faça code review focado em fluxos de segurança e use bibliotecas de criptografia testadas em vez de implementar do zero; adicione testes que forcem a falha se a etapa for pulada.

CVE-2026-28498HIGHAuthlib: Fail-Open Cryptographic Verification in OIDC Hash BindingEPSS 0.2%CVE-2023-40012MEDIUMuthenticode EKU validation bypassEPSS 0.2%CVE-2026-22863CRITICALDeno node:crypto doesn't finalize cipherEPSS 0.2%CVE-2026-17666CRITICALCryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to bypass discEPSS 0.2%CVE-2026-48480MEDIUMnetty-incubator-codec-ohttp OHttpVersionChunkDraft's Missing Final-Chunk Enforcement Leads to Undetected Stream TruncationEPSS 0.2%CVE-2026-55144HIGHWindows Cryptography API: Next Generation (CNG) Tampering VulnerabilityEPSS 0.2%CVE-2026-49440HIGHDeno: Miller-Rabin Primality Test Allows Zero RoundsEPSS 0.1%CVE-2026-41395HIGHOpenClaw < 2026.3.28 - Webhook Replay via Query Parameter Reordering in Plivo V3EPSS 0.1%CVE-2026-59776HIGHMissing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips shipped in or before 2017. If the vulnerability is explEPSS 0.1%CVE-2015-20112LOWRLPx 5 has two CTR streams based on the same key, IV, and nonce. This can facilitate decryption on a private network.EPSS 0.1%CVE-2026-0420MEDIUMMissing TLS certificate validation in NETGEAR's ReadyCloud client appEPSS 0.1%CVE-2025-47383HIGHMissing Cryptographic Step in Data ModemEPSS 0.1%CVE-2026-6458MEDIUMAES-256-GCM Authentication Tag Does Not Cover First Ciphertext Blocks When AAD Is EmptyEPSS 0.1%CVE-2026-29142MEDIUMPlaintext secure-mail.htmlEPSS 0.1%CVE-2025-49600MEDIUMIn MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid signatures if hash computation fails and internal errors go unchecked, EPSS 0.1%CVE-2025-5323MEDIUMfossasia open-event-server Mail Verification mail.py send_email_change_user_email reliance on obfuscation or encryption of security-relevant inputs without integrity checkingEPSS 0.1%CVE-2025-69418MEDIUMUnauthenticated/unencrypted trailing bytes with low-level OCB function callsEPSS 0.1%CVE-2025-59339MEDIUMThe Bastion ttyrec files are not signed after encryption by the osh-encrypt-rsync scriptEPSS 0.1%CVE-2026-9266HIGHA Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and contrEPSS 0.1%