Fallos del tipo CWE-640

199 resultados

Mecanismo fraco de recuperação de senha

A aplicação usa um processo de recuperação de senha insuficientemente seguro, permitindo que um atacante redefina a senha de outro usuário sem autenticação adequada. Isso acontece quando perguntas de segurança são previsíveis, tokens de recuperação não expiram, ou a validação de identidade é inadequada — abrindo caminho para takeover de conta.

Ejemplo

Um banco que envia um link de reset com token válido por 30 dias, ou um e-commerce que valida recuperação apenas perguntando a data de nascimento do cadastro (informação frequentemente pública). Um atacante consegue acessar contas alheias explorando essas fraquezas.

Cómo mitigar

Use tokens criptograficamente fortes e com expiração curta (15-60 min), exija confirmação em múltiplos canais (SMS + email), implemente rate limiting para tentativas de reset, e evite perguntas de segurança previsíveis ou públicas. Valide a identidade com dados realmente privados ou biometria quando possível.

CVE-2024-11350CRITICALAdForest <= 5.1.6 - Privilege Escalation via Password Reset/Account TakeoverEPSS 0.7%CVE-2024-9305HIGHAppPresser – Mobile App Framework <= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTPEPSS 0.7%CVE-2024-47547CRITICALRuijie Reyee OS Weak Password Recovery Mechanism for Forgotten PasswordEPSS 0.7%CVE-2020-37172HIGHAVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)EPSS 0.7%CVE-2022-37300CRITICALA CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and wriEPSS 0.7%CVE-2023-5840MEDIUMWeak Password Recovery Mechanism for Forgotten Password in linkstackorg/linkstackEPSS 0.7%CVE-2026-28268CRITICALVikunja Vulnerable to Account Takeover via Password Reset Token ReuseEPSS 0.7%CVE-2022-50910HIGHBeehive Forum - Account TakeoverEPSS 0.7%CVE-2026-11551CRITICALBranda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account TakeoverEPSS 0.6%CVE-2022-47697CRITICALCOMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 and before is vulnerable to Account takeovEPSS 0.6%CVE-2023-7264HIGHBuild App Online <= 1.0.22 - Account Takeover via Weak Password Reset MechanismEPSS 0.6%CVE-2023-35717HIGHTP-Link Tapo C210 Password Recovery Authentication Bypass VulnerabilityEPSS 0.6%CVE-2026-25858CRITICALmacrozheng mall <= 1.0.3 Unauthenticated Password Reset via OTP DisclosureEPSS 0.6%CVE-2025-10127HIGHDaikin Europe N.V Security Gateway Weak Password Recovery Mechanism for Forgotten PasswordEPSS 0.6%CVE-2024-0186LOWHuiRan Host Reseller System HTTP POST Request password recoveryEPSS 0.6%CVE-2024-9302HIGHApp Builder – Create Native Android & iOS Apps On The Flight <= 5.3.7 - Privilege Escalation and Account Takeover via Weak OTPEPSS 0.6%CVE-2021-27654HIGHForgotten password reset functionality for local accounts can be used to bypass local authentication checks.EPSS 0.6%CVE-2025-64113CRITICALEmby Server allows attackers to gain administrative server access without preconditionsEPSS 0.6%CVE-2023-47107HIGHPILOS account takeover through password reset poisoningEPSS 0.6%CVE-2024-2463HIGHWeak password recovery mechanism in CDeXEPSS 0.6%