目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-287 认证机制不恰当 类漏洞列表 1744

CWE-287 认证机制不恰当 类弱点 1744 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-287 属于身份验证缺陷漏洞，指系统在验证用户身份时未能充分核实其声明的真实性。攻击者常利用此弱点通过暴力破解、凭证填充或会话劫持等手段冒充合法用户，从而获取未授权访问权限。开发者应实施多因素认证、使用强哈希算法存储凭证、设置合理的账户锁定策略，并严格验证每次访问的身份凭证，以确保身份声明得到充分证明。

MITRE CWE 官方描述
CWE：CWE-287 Improper Authentication 英文：当某个actor声称具有某一特定身份时，产品未能证明或未能充分证明该声明是正确的。
常见影响 (1)
Integrity, Confidentiality, Availability, Access Control Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands
This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.
缓解措施 (1)
Architecture and Design Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
代码示例 (2)
The following code intends to ensure that the user is already logged in. If not, the code performs authentication with the user-provided username and password. If successful, it sets the loggedin and user cookies to "remember" that the user has already logged in. Finally, the code performs administrator tasks if the logged-in user has the "Administrator" username, as recorded in the user cookie.
my $q = new CGI; if ($q->cookie('loggedin') ne "true") { if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("Error: you need to log in first"); } else { # Set loggedin and user cookies. $q->cookie( -name => 'loggedin', -value => 'true' ); $q->cookie( -name => 'user', -value => $q->param('username') ); } } if ($q->cookie('user') eq "Administrator") { DoAdministratorTasks(); }
Bad · Perl
GET /cgi-bin/vulnerable.cgi HTTP/1.1 Cookie: user=Administrator Cookie: loggedin=true [body of request]
Attack
In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts [REF-236]. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force attack by guessing a large number of common words. After gaining access as the member of the support st…
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-107808 Nginx UI 认证绕过：密码登录未强制启用2FA — nginx-ui 8.1 High 2026-10-09
CVE-2026-108108 PHPNuxBill 2025.3.20 CHAP认证绕过漏洞 — phpnuxbill 7.1 High 2026-10-09
CVE-2026-107910 FalkorDB Bolt端点认证绕过漏洞 — FalkorDB 8.1 High 2026-10-09
CVE-2026-105672 TP-Link Tapo C325WB 未认证 JSON API 授权绕过漏洞 — Tapo C325WB v2 8.7 High 2026-10-08
CVE-2026-16823 IBM Verify Access 安全漏洞 — Security Verify Access 9.1 Critical 2026-10-08
CVE-2026-19491 IBM Verify Identity Access 安全漏洞 — Security Verify Access 9.1 Critical 2026-10-08
CVE-2026-19494 IBM Verify Identity Access 远程代码执行漏洞 — Security Verify Access 8.1 High 2026-10-08
CVE-2026-105832 EspoCRM 10.0.6前双因素认证绕过漏洞 — espocrm 4.3 Medium 2026-10-08
CVE-2026-14502 IBM DataPower Gateway 身份验证缺陷漏洞 — DataPower Gateway 10.6CD 9.8 Critical 2026-10-08
CVE-2026-107228 AsyncHttpClient CookieStore 静默覆盖调用者显式 Cookie 标头 — async-http-client 6.8 Medium 2026-10-07
CVE-2026-46437 wger登出或密码变更后API凭据仍有效 — wger 4.8 Medium 2026-10-07
CVE-2026-107180 MISP OTP强制注册绕过漏洞 — MISP 7.1 High 2026-10-07
CVE-2026-107162 Express Gateway 1.16.11 OAuth 2.0 刷新令牌验证绕过漏洞 — express-gateway 6.8 Medium 2026-10-07
CVE-2026-83540 wolfSSHd on Windows 登录令牌跨连接重用漏洞 — wolfSSH 7.7 High 2026-10-07
CVE-2026-106488 Backstage OIDC提供者认证不当漏洞 — backstage 8.1 High 2026-10-06
CVE-2026-106460 Backstage OAuth 个人资料归一化时电子邮件验证绕过漏洞 — backstage 6.8 Medium 2026-10-06
CVE-2026-106457 Apache Backstage Cloudflare Access 身份验证不足漏洞 — backstage 6.8 Medium 2026-10-06
CVE-2026-73278 Gitea WebAuthn绕过OAuth和OIDC登录漏洞 — Gitea - - 2026-10-06
CVE-2026-105305 Keycloak-services 客户端最小 ACR 值强制执行绕过 — Red Hat Build of Keycloak 5.4 Medium 2026-10-06
CVE-2026-59358 UAA OAuth令牌端点允许client_credentials类型令牌重用 — UAA 7.6 High 2026-10-06
CVE-2026-105704 SourceCodester Drug Recommendation System 身份验证漏洞 — Drug Recommendation System 7.3 High 2026-10-06
CVE-2026-105640 Plane: 通过未验证的OAuth邮箱匹配导致账户接管漏洞（Gitea，自托管GitLab） — plane 9.1 Critical 2026-10-05
CVE-2026-105213 ZITADEL 4.17.1 前身份验证绕过漏洞 — zitadel 8.2 High 2026-10-04
CVE-2026-105212 ZITADEL 3.4.14/4.16.2 前账号接管漏洞 — zitadel 7.5 High 2026-10-04
CVE-2026-105210 ZITADEL 4.17.1 前未认证MFA注册漏洞 — zitadel 8.2 High 2026-10-04
CVE-2026-105133 AhsayCBS ApiStructsAction.java 身份验证缺陷漏洞 — AhsayCBS 7.3 High 2026-10-04
CVE-2026-97343 Burst Statistics 3.7.1 及之前版本 身份验证绕过漏洞 — Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) 4.3 Medium 2026-10-03
CVE-2026-104638 onetwothreeneth HospitalManagementSystem sessions.php 认证绕过 — HospitalManagementSystem 5.3 Medium 2026-10-02
CVE-2026-97637 JSON API Auth <=3.1.2 未授权认证绕过漏洞 — JSON API Auth 9.8 Critical 2026-10-02
CVE-2026-19660 Divi Membership <=2.3.0 未认证身份绕过漏洞 — Divi Membership 9.8 Critical 2026-10-02

CWE-287（认证机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1744 条 CVE 漏洞。