目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-287 认证机制不恰当 类漏洞列表 1744

CWE-287 认证机制不恰当 类弱点 1744 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-287 属于身份验证缺陷漏洞，指系统在验证用户身份时未能充分核实其声明的真实性。攻击者常利用此弱点通过暴力破解、凭证填充或会话劫持等手段冒充合法用户，从而获取未授权访问权限。开发者应实施多因素认证、使用强哈希算法存储凭证、设置合理的账户锁定策略，并严格验证每次访问的身份凭证，以确保身份声明得到充分证明。

MITRE CWE 官方描述
CWE：CWE-287 Improper Authentication 英文：当某个actor声称具有某一特定身份时，产品未能证明或未能充分证明该声明是正确的。
常见影响 (1)
Integrity, Confidentiality, Availability, Access Control Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands
This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.
缓解措施 (1)
Architecture and Design Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
代码示例 (2)
The following code intends to ensure that the user is already logged in. If not, the code performs authentication with the user-provided username and password. If successful, it sets the loggedin and user cookies to "remember" that the user has already logged in. Finally, the code performs administrator tasks if the logged-in user has the "Administrator" username, as recorded in the user cookie.
my $q = new CGI; if ($q->cookie('loggedin') ne "true") { if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("Error: you need to log in first"); } else { # Set loggedin and user cookies. $q->cookie( -name => 'loggedin', -value => 'true' ); $q->cookie( -name => 'user', -value => $q->param('username') ); } } if ($q->cookie('user') eq "Administrator") { DoAdministratorTasks(); }
Bad · Perl
GET /cgi-bin/vulnerable.cgi HTTP/1.1 Cookie: user=Administrator Cookie: loggedin=true [body of request]
Attack
In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts [REF-236]. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force attack by guessing a large number of common words. After gaining access as the member of the support st…
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-107186 Eptura Archibus DWR API 特权会话重用认证绕过漏洞 — Archibus 8.6 High 2026-10-19
CVE-2026-85301 Apache Camel 远程代码执行漏洞 — Apache Camel 4.8 Medium 2026-10-19
CVE-2026-84181 Apache Camel 认证绕过漏洞 — Apache Camel 5.9 Medium 2026-10-19
CVE-2026-80312 Apache Camel OAuth 身份验证绕过漏洞 — Apache Camel 8.2 High 2026-10-19
CVE-2026-112044 eShop Catalog API 认证绕过漏洞 — eShop 7.3 High 2026-10-19
CVE-2026-104627 Gitea OpenID 账户链接会话绑定缺失漏洞 — Gitea - - 2026-10-18
CVE-2026-111911 phpMyFAQ 4.0.0-4.1.9 WebAuthn 认证绕过漏洞 — phpMyFAQ 9.8 Critical 2026-10-17
CVE-2026-111898 phpMyFAQ 4.2.0 账户接管漏洞 — phpMyFAQ 7.5 High 2026-10-17
CVE-2026-111895 phpMyFAQ 4.2.0 前版本 Entra ID 账户接管漏洞 — phpMyFAQ 6.8 Medium 2026-10-17
CVE-2026-111882 phpMyFAQ 4.2.0 单点登录绕过双因素认证漏洞 — phpMyFAQ 8.1 High 2026-10-17
CVE-2026-110653 Appointment Booking Plugin 5.7.4 认证绕过漏洞 — Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress 9.1 Critical 2026-10-17
CVE-2026-68573 Apache Kylin 未认证元存储清理漏洞 — Apache Kylin - - 2026-10-16
CVE-2026-17488 IBM i SST/DST 认证绕过漏洞 — i 4.3 Medium 2026-10-16
CVE-2026-111639 bbs-go 4.4.6 通过 Google One Tap 登录的账户接管漏洞 — bbs-go 8.1 High 2026-10-16
CVE-2026-75903 Vulnity Security 1.4.3 未认证认证绕过漏洞 — Vulnity Security 8.1 High 2026-10-16
CVE-2026-103895 miniOrange OTP 5.5.8 未认证认证绕过漏洞 — miniOrange OTP Login, Verification and SMS Notifications 8.1 High 2026-10-16
CVE-2026-104198 ZoneMinder 令牌处理缺陷绕过Web认证 — zoneminder 5.3 Medium 2026-10-15
CVE-2026-57183 Scoold JWT伪造导致未授权访问敏感配置和日志漏洞 — scoold 6.1 Medium 2026-10-15
CVE-2026-102631 authd 身份匹配后邮箱重新分配导致账户接管漏洞 — authd 5.9 Medium 2026-10-15
CVE-2026-45451 Unitronics 身份验证不当漏洞 — Unitronics UniStream Pro/UniLogic 8.3 High 2026-10-15
CVE-2026-110864 Better Auth 1.5.0-beta.12至1.7.7 OAuth代理绕过认证漏洞 — better-auth 7.4 High 2026-10-14
CVE-2026-110863 Better Auth <1.7.3 SSO认证绕过漏洞 — sso 8.1 High 2026-10-14
CVE-2026-110862 Better Auth 1.4.0-beta.18 至 1.7.7 身份验证绕过漏洞 — better-auth 9.1 Critical 2026-10-14
CVE-2026-104108 FileRise OIDC登录可绑定攻击者身份至现有本地账户 — FileRise 8.1 High 2026-10-14
CVE-2026-104105 FileRise TOTP验证码可重放漏洞 — FileRise 6.4 Medium 2026-10-14
CVE-2026-69191 FileRise 直接API访问绕过登录限制漏洞 — FileRise 5.4 Medium 2026-10-14
CVE-2026-102899 Sentry SAML SSO 身份认证不当导致用户身份链接漏洞 — sentry 7.6 High 2026-10-14
CVE-2026-109506 TP-Link多款WiFi中继器身份认证绕过漏洞 — RE190 v5 5.9 Medium 2026-10-14
CVE-2026-107350 PgBouncer SCRAM认证期间通过第二个StartupMessage绕过认证漏洞 — PgBouncer 8.8 High 2026-10-14
CVE-2026-101954 Junos OS/Junos OS Evolved 远程代码执行漏洞 — Junos OS 9.8 Critical 2026-10-14

CWE-287（认证机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1744 条 CVE 漏洞。