CWE-287 认证机制不恰当 类弱点 1744 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-287 属于身份验证缺陷漏洞，指系统在验证用户身份时未能充分核实其声明的真实性。攻击者常利用此弱点通过暴力破解、凭证填充或会话劫持等手段冒充合法用户，从而获取未授权访问权限。开发者应实施多因素认证、使用强哈希算法存储凭证、设置合理的账户锁定策略，并严格验证每次访问的身份凭证，以确保身份声明得到充分证明。
my $q = new CGI; if ($q->cookie('loggedin') ne "true") { if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("Error: you need to log in first"); } else { # Set loggedin and user cookies. $q->cookie( -name => 'loggedin', -value => 'true' ); $q->cookie( -name => 'user', -value => $q->param('username') ); } } if ($q->cookie('user') eq "Administrator") { DoAdministratorTasks(); }GET /cgi-bin/vulnerable.cgi HTTP/1.1 Cookie: user=Administrator Cookie: loggedin=true [body of request]| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-81473 | Dell RCC低于5.2.206存在权限提升漏洞 — Rugged Control Center (RCC) | 8.1 | High | 2026-09-24 |
| CVE-2026-85056 | ZITADEL 登录V2 会话复用导致MFA绕过漏洞 — zitadel | 8.2 | High | 2026-09-24 |
| CVE-2026-57178 | social-auth-core VK应用后端签名验证缺失漏洞 — social-core | 7.4 | High | 2026-09-24 |
| CVE-2026-57175 | social-auth-core 身份验证缺陷 — social-core | 6.4 | Medium | 2026-09-24 |
| CVE-2026-94606 | authentik MFA绕过漏洞：状态混淆/参数注入 — authentik | 8.9 | High | 2026-09-24 |
| CVE-2026-94612 | authentik SAML断言混淆导致身份验证绕过漏洞 — authentik | 7.4 | High | 2026-09-24 |
| CVE-2026-56737 | phpMyFAQ 两步认证绕过密码 — phpMyFAQ | 8.1 | High | 2026-09-24 |
| CVE-2026-78308 | DIAEnergie 身份验证绕过漏洞 — DIAEnergie | 9.8 | Critical | 2026-09-24 |
| CVE-2026-19125 | EthPress <= 2.3.5 未授权身份绕过漏洞 — EthPress – Web3 Login | 8.1 | High | 2026-09-23 |
| CVE-2026-95676 | AuthPoint Gateway LDAP同步身份认证绕过漏洞 — AuthPoint Authentication Gateway | 7.4 | High | 2026-09-23 |
| CVE-2026-75973 | Apache Tomcat 跨上下文认证混淆漏洞 — Apache Tomcat | - | - | 2026-09-23 |
| CVE-2026-96445 | Keycloak 代理头部条件OTP绕过漏洞 — Red Hat Build of Keycloak | 6.8 | Medium | 2026-09-23 |
| CVE-2026-31377 | Apache Doris FE元服务身份验证不当漏洞 — Apache Doris | 7.5 | High | 2026-09-23 |
| CVE-2026-18074 | IBM FTM 远程代码执行漏洞 — Financial Transaction Manager (FTM) for RedHat OpenShift | 8.2 | High | 2026-09-22 |
| CVE-2026-77244 | mcp-atlassian HTTP传输认证绕过漏洞 — mcp-atlassian | 10.0 | Critical | 2026-09-22 |
| CVE-2026-65121 | NVIDIA Linux控制器认证不当漏洞 — Infrastructure Controller | 8.2 | High | 2026-09-22 |
| CVE-2026-95271 | changedetection.io 认证钩子身份验证不当漏洞 — changedetection.io | 7.3 | High | 2026-09-22 |
| CVE-2026-61687 | Hatchet 空状态冲突致 OAuth 跨站请求伪造 — hatchet | 7.1 | High | 2026-09-21 |
| CVE-2026-61630 | Nginx Ignition TOTP 重放漏洞 — nginx-ignition | 4.2 | Medium | 2026-09-21 |
| CVE-2026-93984 | OpenPanel 客户端密钥未验证认证绕过漏洞 — openpanel | 5.3 | Medium | 2026-09-19 |
| CVE-2026-89093 | Better Messages 2.15.33 信息泄露漏洞 — Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots | 5.3 | Medium | 2026-09-19 |
| CVE-2026-75878 | IBM Sterling File Gateway 身份验证绕过漏洞 — Sterling File Gateway | 9.1 | Critical | 2026-09-18 |
| CVE-2026-93532 | gedelumbung医院管理系统密码验证绕过漏洞 — HospitalManagement | 6.3 | Medium | 2026-09-18 |
| CVE-2024-38639 | QTS — QTS | 4.8 | Medium | 2026-09-18 |
| CVE-2026-82980 | DAV插件跨用户文件锁定漏洞 — Files Lock | - | - | 2026-09-18 |
| CVE-2026-54510 | Speakr CSRF API令牌钩子绕过漏洞 — speakr | 7.1 | High | 2026-09-17 |
| CVE-2026-85716 | AsyncHttpClient 身份认证响应未校验漏洞 — async-http-client | 3.7 | Low | 2026-09-17 |
| CVE-2026-63472 | Vendure外部认证账户接管漏洞 — vendure | 9.1 | Critical | 2026-09-17 |
| CVE-2026-88952 | AshAuthentication OAuth2 账户链接逻辑缺陷 — ash_authentication | 9.1 | Critical | 2026-09-17 |
| CVE-2026-80218 | AshAuthentication 登录令牌跨资源复用漏洞 — ash_authentication | 7.6 | High | 2026-09-17 |
CWE-287（认证机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1744 条 CVE 漏洞。