目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-287 认证机制不恰当 类漏洞列表 1540

CWE-287 认证机制不恰当 类弱点 1540 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-287 属于身份验证缺陷漏洞，指系统在验证用户身份时未能充分核实其声明的真实性。攻击者常利用此弱点通过暴力破解、凭证填充或会话劫持等手段冒充合法用户，从而获取未授权访问权限。开发者应实施多因素认证、使用强哈希算法存储凭证、设置合理的账户锁定策略，并严格验证每次访问的身份凭证，以确保身份声明得到充分证明。

MITRE CWE 官方描述
CWE：CWE-287 Improper Authentication 英文：当某个actor声称具有某一特定身份时，产品未能证明或未能充分证明该声明是正确的。
常见影响 (1)
Integrity, Confidentiality, Availability, Access Control Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands
This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.
缓解措施 (1)
Architecture and Design Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
代码示例 (2)
The following code intends to ensure that the user is already logged in. If not, the code performs authentication with the user-provided username and password. If successful, it sets the loggedin and user cookies to "remember" that the user has already logged in. Finally, the code performs administrator tasks if the logged-in user has the "Administrator" username, as recorded in the user cookie.
my $q = new CGI; if ($q->cookie('loggedin') ne "true") { if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("Error: you need to log in first"); } else { # Set loggedin and user cookies. $q->cookie( -name => 'loggedin', -value => 'true' ); $q->cookie( -name => 'user', -value => $q->param('username') ); } } if ($q->cookie('user') eq "Administrator") { DoAdministratorTasks(); }
Bad · Perl
GET /cgi-bin/vulnerable.cgi HTTP/1.1 Cookie: user=Administrator Cookie: loggedin=true [body of request]
Attack
In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts [REF-236]. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force attack by guessing a large number of common words. After gaining access as the member of the support st…
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-54047 Laci Synchroni 账户接管与用户身份冒充漏洞 — server 9.2 Critical 2026-09-11
CVE-2026-71416 Headroom 跨站WebSocket劫持漏洞 — headroom 8.8 High 2026-09-11
CVE-2026-82107 DataStage 开源组件远程代码执行漏洞 — DataStage on Cloud Pak for Data 9.6 Critical 2026-09-10
CVE-2026-88018 rclone S3服务SigV4签名验证绕过漏洞 — rclone 9.8 Critical 2026-09-10
CVE-2026-88007 Traefik HTTP/3 后端 NTLM 连接复用漏洞 — traefik 9.1 Critical 2026-09-10
CVE-2026-88895 CyberPanel 3.0.5之前版本认证绕过漏洞 — cyberpanel 7.2 High 2026-09-10
CVE-2026-47156 MantisBT SOAP API认证绕过致管理员提权漏洞 — mantisbt 9.3 Critical 2026-09-09
CVE-2026-87806 Parse Server 9.0.0 认证绕过漏洞 — parse-server 7.4 High 2026-09-09
CVE-2026-79974 Dell SCG 5.0 特定版本身份认证不当漏洞 — Secure Connect Gateway 5.0 - Application 6.4 Medium 2026-09-09
CVE-2026-80099 Newfold插件 未认证认证绕过漏洞 — WP Plugin Web 8.8 High 2026-09-09
CVE-2026-76009 Next-Cart Store迁移插件3.9.8认证绕过漏洞 — Next-Cart Store to WooCommerce Migration 8.1 High 2026-09-09
CVE-2026-78560 Okta Access Gateway 认证验证不当 — Okta Access Gateway 4.8 Medium 2026-09-08
CVE-2026-86810 Open-Web-Analytics 认证不当漏洞 — Open-Web-Analytics 7.3 High 2026-09-08
CVE-2026-69854 Microsoft Spring Cloud Azure 授权问题漏洞 — Spring Cloud Azure 9.0 Critical 2026-09-08
CVE-2026-86669 iWebShop-5 系统 登录认证不当漏洞 — iWebShop-5 7.3 High 2026-09-08
CVE-2026-80097 Microsoft Authenticator 权限提升漏洞 — Microsoft Authenticator for Android 8.6 High 2026-09-08
CVE-2026-86723 AVideo LoginControl 认证绕过漏洞 — AVideo 8.1 High 2026-09-08
CVE-2026-86721 AVideo 会话cookie认证绕过漏洞 — AVideo 7.5 High 2026-09-08
CVE-2026-86722 AVideo 认证绕过 — AVideo 8.1 High 2026-09-08
CVE-2026-82758 Ash Framework AshAuthentication.Oauth2Server 授权问题漏洞 — ash_authentication_oauth2_server 6.3 Medium 2026-09-07
CVE-2026-18922 389 Directory Server 授权问题漏洞 — Red Hat Directory Server 11.7 E4S for RHEL 8 9.8 Critical 2026-09-07
CVE-2026-80128 Dell Secure Connect Gateway 授权问题漏洞 — Secure Connect Gateway 5.0 - Application 6.4 Medium 2026-09-07
CVE-2026-86306 light0011 cms 授权问题漏洞 — cms 7.3 High 2026-09-07
CVE-2026-86426 LibreNMS 授权问题漏洞 — librenms 9.2 Critical 2026-09-07
CVE-2026-86300 Tenda AC9 授权问题漏洞 — AC9 7.3 High 2026-09-07
CVE-2026-86214 Mustafa Aktas College-Management-System 授权问题漏洞 — Mstfakts College-Management-System 7.3 High 2026-09-06
CVE-2026-75816 shabti Frontend Admin by DynamiApps 授权问题漏洞 — Frontend Admin by DynamiApps 9.8 Critical 2026-09-06
CVE-2026-18056 HivePress Authentication 授权问题漏洞 — HivePress Authentication 7.5 High 2026-09-06
CVE-2026-86117 coolLabs Coolify 授权问题漏洞 — coolify 8.1 High 2026-09-05
CVE-2026-13447 WordPress MStore API 授权问题漏洞 — MStore API – Create Native Android & iOS Apps On The Cloud 9.8 Critical 2026-09-05

CWE-287（认证机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1540 条 CVE 漏洞。