目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-287 认证机制不恰当 类漏洞列表 1744

CWE-287 认证机制不恰当 类弱点 1744 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-287 属于身份验证缺陷漏洞，指系统在验证用户身份时未能充分核实其声明的真实性。攻击者常利用此弱点通过暴力破解、凭证填充或会话劫持等手段冒充合法用户，从而获取未授权访问权限。开发者应实施多因素认证、使用强哈希算法存储凭证、设置合理的账户锁定策略，并严格验证每次访问的身份凭证，以确保身份声明得到充分证明。

MITRE CWE 官方描述
CWE：CWE-287 Improper Authentication 英文：当某个actor声称具有某一特定身份时，产品未能证明或未能充分证明该声明是正确的。
常见影响 (1)
Integrity, Confidentiality, Availability, Access Control Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands
This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.
缓解措施 (1)
Architecture and Design Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
代码示例 (2)
The following code intends to ensure that the user is already logged in. If not, the code performs authentication with the user-provided username and password. If successful, it sets the loggedin and user cookies to "remember" that the user has already logged in. Finally, the code performs administrator tasks if the logged-in user has the "Administrator" username, as recorded in the user cookie.
my $q = new CGI; if ($q->cookie('loggedin') ne "true") { if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("Error: you need to log in first"); } else { # Set loggedin and user cookies. $q->cookie( -name => 'loggedin', -value => 'true' ); $q->cookie( -name => 'user', -value => $q->param('username') ); } } if ($q->cookie('user') eq "Administrator") { DoAdministratorTasks(); }
Bad · Perl
GET /cgi-bin/vulnerable.cgi HTTP/1.1 Cookie: user=Administrator Cookie: loggedin=true [body of request]
Attack
In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts [REF-236]. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force attack by guessing a large number of common words. After gaining access as the member of the support st…
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-14378 DevKit Pro <= 2.3.0 身份认证绕过漏洞 — DevKit Pro 9.8 Critical 2026-10-02
CVE-2026-102369 TP-Link Tapo C120/C200 远程代码执行漏洞 — Tapo C200 v5 8.7 High 2026-10-01
CVE-2026-94276 Apache APISIX OIDC验证绕过漏洞 — Apache APISIX 5.1 Medium 2026-10-01
CVE-2026-103264 Fleet 4.87.0前设备标识认证绕过漏洞 — fleet 9.1 Critical 2026-10-01
CVE-2026-75957 Ultimate Multisite 2.15.0 认证绕过漏洞 — Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform 9.8 Critical 2026-10-01
CVE-2026-102106 Kiteworks邮件网关身份验证不当漏洞 — Email Protection Gateway 9.1 Critical 2026-09-30
CVE-2026-102128 Kiteworks邮件网关身份验证不当漏洞 — Email Protection Gateway 7.5 High 2026-09-30
CVE-2026-92227 Joomla 4.0.0-6.1.3 身份验证绕过漏洞 — Joomla! CMS 8.2 High 2026-09-29
CVE-2026-102248 Rebuild Login 端点登录认证不当漏洞 — Rebuild 7.3 High 2026-09-29
CVE-2026-101281 OpenDMARC opendmarc_spf.c 认证绕过漏洞 — OpenDMARC 7.3 High 2026-09-29
CVE-2026-102364 mall4j 4.0 之前版本 管理API不当认证漏洞 — mall4j 5.4 Medium 2026-09-28
CVE-2026-101073 Netcore NR289-GE CGI认证不当漏洞 — NR289-GE 8.3 High 2026-09-28
CVE-2026-52749 Kaon AR2140X 身份验证不当漏洞 — AR2140 5.3 Medium 2026-09-28
CVE-2026-100886 Seetong T8108/T8108P/T8116/T8232 调试服务认证缺陷 — T8108 10.0 Critical 2026-09-27
CVE-2026-101050 Heym 0.0.53 之前通过 Telegram Webhook 绕过认证漏洞 — heym 6.5 Medium 2026-09-27
CVE-2026-101049 Heym < 0.0.53 Slack Webhook 签名验证绕过漏洞 — heym 6.5 Medium 2026-09-27
CVE-2026-101042 Parse Server 9.0.0 通过未验证提供者身份的认证绕过漏洞 — parse-server 6.4 Medium 2026-09-27
CVE-2026-100871 Sylius <1.12.25 JWT 受众混淆导致管理 API 认证漏洞 — Sylius 8.8 High 2026-09-27
CVE-2026-89136 客户端接受未请求的RawPublicKey服务器证书类型 — wolfSSL 8.3 High 2026-09-27
CVE-2026-94419 客户端会话缓存引用中毒导致与错误服务器恢复连接 — wolfSSL 2.3 Low 2026-09-27
CVE-2026-85984 miniOrange OTP Login ≤5.5.5 未认证绕过漏洞 — miniOrange OTP Login, Verification and SMS Notifications 9.8 Critical 2026-09-26
CVE-2026-100709 Froxlor 2.3.12 之前 2FA 绕过漏洞 — froxlor 7.5 High 2026-09-26
CVE-2026-100684 Budibase Server 3.41.0至3.44.0 OIDC身份绕过漏洞 — server 8.1 High 2026-09-26
CVE-2026-100607 Flowise 3.1.4 及以下版本邮箱单点登录绕过认证漏洞 — Flowise 7.7 High 2026-09-26
CVE-2026-100606 Flowise 3.1.4 通过 SSO 邮箱匹配绕过身份验证漏洞 — Flowise 7.7 High 2026-09-26
CVE-2026-84458 Zammad SSO自动关联时未验证邮箱导致账户接管漏洞 — zammad 9.1 Critical 2026-09-25
CVE-2026-97063 Spring Boot 6.0 登录验证码绕过漏洞 — X-SpringBoot 9.1 Critical 2026-09-25
CVE-2026-56727 Zammad PGP签名伪造漏洞 — zammad 7.1 High 2026-09-25
CVE-2026-97846 Keycloak keycloak-services mtls持有密钥绑定绕过漏洞 — Red Hat Build of Keycloak 6.8 Medium 2026-09-25
CVE-2026-56792 Dell RCC漏洞：5.2.206前版本提权 — Rugged Control Center (RCC) 4.4 Medium 2026-09-24

CWE-287（认证机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1744 条 CVE 漏洞。