目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-287 认证机制不恰当 类漏洞列表 1744

CWE-287 认证机制不恰当 类弱点 1744 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-287 属于身份验证缺陷漏洞，指系统在验证用户身份时未能充分核实其声明的真实性。攻击者常利用此弱点通过暴力破解、凭证填充或会话劫持等手段冒充合法用户，从而获取未授权访问权限。开发者应实施多因素认证、使用强哈希算法存储凭证、设置合理的账户锁定策略，并严格验证每次访问的身份凭证，以确保身份声明得到充分证明。

MITRE CWE 官方描述
CWE：CWE-287 Improper Authentication 英文：当某个actor声称具有某一特定身份时，产品未能证明或未能充分证明该声明是正确的。
常见影响 (1)
Integrity, Confidentiality, Availability, Access Control Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands
This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.
缓解措施 (1)
Architecture and Design Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
代码示例 (2)
The following code intends to ensure that the user is already logged in. If not, the code performs authentication with the user-provided username and password. If successful, it sets the loggedin and user cookies to "remember" that the user has already logged in. Finally, the code performs administrator tasks if the logged-in user has the "Administrator" username, as recorded in the user cookie.
my $q = new CGI; if ($q->cookie('loggedin') ne "true") { if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("Error: you need to log in first"); } else { # Set loggedin and user cookies. $q->cookie( -name => 'loggedin', -value => 'true' ); $q->cookie( -name => 'user', -value => $q->param('username') ); } } if ($q->cookie('user') eq "Administrator") { DoAdministratorTasks(); }
Bad · Perl
GET /cgi-bin/vulnerable.cgi HTTP/1.1 Cookie: user=Administrator Cookie: loggedin=true [body of request]
Attack
In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts [REF-236]. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force attack by guessing a large number of common words. After gaining access as the member of the support st…
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-116371 Akuvox Akubela HyPanel PS51 登录认证绕过漏洞 — Akubela HyPanel PS51 6.3 Medium 2026-10-26
CVE-2026-116163 Parse Server 9.0.0 至 9.10.5-alpha.2 认证绕过漏洞 — parse-server 7.4 High 2026-10-25
CVE-2026-116006 若依 SMS 验证码认证逻辑缺陷 — ruoyi-vue-pro 7.3 High 2026-10-25
CVE-2026-55459 Goobi viewer OpenID JWT 受众验证绕过漏洞 — goobi-viewer-core 7.4 High 2026-10-23
CVE-2026-55457 Goobi viewer 默认空令牌导致未授权访问绕过 — goobi-viewer-core 7.4 High 2026-10-23
CVE-2026-56837 PraisonAI LinearBot 远程代码执行漏洞 — PraisonAI 8.6 High 2026-10-23
CVE-2026-56836 PraisonAI recipe serve 命令绕过非本地认证漏洞 — PraisonAI 8.2 High 2026-10-23
CVE-2026-93489 ASUS 路由器固件身份验证绕过漏洞 — Router 8.7 High 2026-10-23
CVE-2026-97785 AAD 应用代理权限提升漏洞 — Microsoft Entra application proxy 10.0 Critical 2026-10-22
CVE-2026-114618 Authlib 默认 JWT 授权错误受众漏洞 — authlib 6.8 Medium 2026-10-22
CVE-2026-114616 Authlib 空 HMAC 密钥导致 JWS/JWT 签名伪造漏洞 — authlib 7.4 High 2026-10-22
CVE-2026-114607 better-auth OAuth 状态跨用户登录漏洞 — better-auth 9.1 Critical 2026-10-22
CVE-2026-115333 Lotus 0.10.2 事件摄入 API 密钥前缀认证绕过漏洞 — lotus 5.9 Medium 2026-10-22
CVE-2026-114222 NewType NT OneAPP 身份验证绕过漏洞 — NT OneAPP 6.2 Medium 2026-10-22
CVE-2026-114638 Traefik v3.7.0 客户端 CA 混淆漏洞 — traefik 8.7 High 2026-10-22
CVE-2026-114639 Traefik 2.11.58 前及 3.7.14 前认证绕过漏洞 — traefik 8.7 High 2026-10-22
CVE-2026-114509 Laravel TokenGuard 非字符串凭证认证绕过漏洞 — framework 9.2 Critical 2026-10-21
CVE-2026-114438 Keycloak 身份验证绕过漏洞 — Red Hat Build of Keycloak 4.2 Medium 2026-10-21
CVE-2026-76474 Cisco 统一通信产品 2026 认证绕过漏洞 — Cisco Emergency Responder 9.8 Critical 2026-10-21
CVE-2026-86249 Apache bRPC 身份验证绕过漏洞 — Apache bRPC - - 2026-10-21
CVE-2026-48830 Apache bRPC 认证绕过漏洞 — Apache bRPC - - 2026-10-21
CVE-2026-93744 IBM i 身份验证绕过漏洞 — i 6.5 Medium 2026-10-20
CVE-2026-113682 Networknt light-4j 2.1.5 空密码 LDAP 认证绕过漏洞 — light-4j 7.4 High 2026-10-20
CVE-2026-105949 Kafka Cruise Control 认证绕过漏洞 8.8 High 2026-10-20
CVE-2026-113469 Active Update 签名验证不当漏洞 — Stormshield Network Security 7.5 High 2026-10-20
CVE-2026-111090 固件更新文件签名验证不当漏洞 — Stormshield Network Security 7.8 High 2026-10-20
CVE-2026-107400 IBM TRIRIGA GWT 模拟认证漏洞 — TRIRIGA Application Platform 8.8 High 2026-10-19
CVE-2026-105815 TP-Link Tapo C210 凭据泄露导致未授权访问漏洞 — Tapo C210 v3.6 7.1 High 2026-10-19
CVE-2026-105814 TP-Link Tapo C210 DS JSON API 身份验证绕过漏洞 — Tapo C210 v3.6 5.3 Medium 2026-10-19
CVE-2026-112775 Craft CMS 5.0.0 至 5.11.0 验证代码重用漏洞 — cms 7.5 High 2026-10-19

CWE-287（认证机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1744 条 CVE 漏洞。