Weaknesses of type CWE-603

22 results

Autenticação implementada apenas no cliente

A autenticação é validada exclusivamente no navegador ou aplicação cliente, sem verificação no servidor. Um atacante remove ou burla essas validações locais acessando a API ou servidor diretamente, contornando completamente o controle de acesso.

Example

Um sistema web que valida login apenas com JavaScript no navegador: o desenvolvedor deixa a rota `/dashboard` sem verificação de sessão no backend. Um atacante acessa a URL diretamente ou faz requisições HTTP diretas para a API, pulando toda a autenticação do cliente.

How to mitigate

Implemente autenticação e autorização sempre no servidor: valide tokens/sessões antes de processar qualquer requisição sensível. Nunca confie em validações feitas no cliente — use-as apenas para experiência do usuário, não para segurança.

CVE-2022-3218—Necta WiFi Mouse (Mouse Server) client-side authentication bypassEPSS 73.5%CVE-2020-6988HIGHRockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versionsEPSS 4.0%CVE-2017-7909—A Use of Client-Side Authentication issue was discovered in Advantech B+B SmartWorx MESR901 firmware versions 1.5.2 and prior. The web interEPSS 2.6%CVE-2020-7591—A vulnerability has been identified in SIPORT MP (All versions < 3.2.1). Vulnerable versions of the device could allow an authenticated attaEPSS 1.5%CVE-2022-33139—A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCEPSS 1.2%CVE-2021-43355HIGHFresenius Kabi Agilia Connect Infusion System use of client side authenticationEPSS 1.0%CVE-2025-24517HIGHUse of client-side authentication issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, a remote attaEPSS 0.8%CVE-2020-27266—In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDanEPSS 0.6%CVE-2024-39375CRITICALUse of Client-Side Authentication in TELSAT marKoni FM TransmitterEPSS 0.6%CVE-2026-1363CRITICALJNC｜IAQS and I6 - Client-Side Enforcement of Server-Side SecurityEPSS 0.5%CVE-2025-12868CRITICALCyberTutor｜New Site Server - Use of Client-Side AuthenticationEPSS 0.5%CVE-2025-62649MEDIUMThe Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for submission of equipEPSS 0.5%CVE-2025-62650HIGHThe Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnostEPSS 0.5%CVE-2024-52327MEDIUMECOVACS lawnmower and vacuum cloud service live video PIN bypassEPSS 0.5%CVE-2024-28627HIGHAn issue in Flipsnack v.18/03/2024 allows a local attacker to obtain sensitive information via the reader.gz.js file.EPSS 0.4%CVE-2024-45785HIGHMUSASI version 3 contains an issue with use of client-side authentication. If this vulnerability is exploited, other users' credential and sEPSS 0.4%CVE-2025-64119CRITICALNuvation Energy BMS Client-side AuthenticationEPSS 0.4%CVE-2026-42098HIGHAuthorization Bypass in Sparx Enterprise ArchitectEPSS 0.4%CVE-2026-8830MEDIUMKeycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via client-side javascript manipulationEPSS 0.4%CVE-2025-61940HIGHMirion Medical EC2 Software NMIS BioDose Use of Client-Side AuthenticationEPSS 0.3%