CWE-287 认证机制不恰当 类弱点 1494 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-287 属于身份验证缺陷漏洞，指系统在验证用户身份时未能充分核实其声明的真实性。攻击者常利用此弱点通过暴力破解、凭证填充或会话劫持等手段冒充合法用户，从而获取未授权访问权限。开发者应实施多因素认证、使用强哈希算法存储凭证、设置合理的账户锁定策略，并严格验证每次访问的身份凭证，以确保身份声明得到充分证明。
my $q = new CGI; if ($q->cookie('loggedin') ne "true") { if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("Error: you need to log in first"); } else { # Set loggedin and user cookies. $q->cookie( -name => 'loggedin', -value => 'true' ); $q->cookie( -name => 'user', -value => $q->param('username') ); } } if ($q->cookie('user') eq "Administrator") { DoAdministratorTasks(); }GET /cgi-bin/vulnerable.cgi HTTP/1.1 Cookie: user=Administrator Cookie: loggedin=true [body of request]| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-11703 | wolfSSL 授权问题漏洞 — wolfSSL | - | - | 2026-06-25 |
| CVE-2026-55962 | wolfSSL 授权问题漏洞 — wolfSSL | - | - | 2026-06-25 |
| CVE-2026-54089 | File Browser 授权问题漏洞 — filebrowser | 9.1 | Critical | 2026-06-25 |
| CVE-2026-55759 | Rocket.Chat 授权问题漏洞 — Rocket.Chat | 7.4 | High | 2026-06-24 |
| CVE-2026-55666 | RocketChat Rocket.Chat 授权问题漏洞 — Rocket.Chat | - | - | 2026-06-24 |
| CVE-2026-13208 | KubeVirt 授权问题漏洞 — Red Hat OpenShift Virtualization 4 | 6.5 | Medium | 2026-06-24 |
| CVE-2026-56237 | Capgo 授权问题漏洞 — Capgo | 9.1 | Critical | 2026-06-24 |
| CVE-2026-56223 | Capgo 授权问题漏洞 — Capgo | 8.7 | High | 2026-06-24 |
| CVE-2026-12112 | The Foreman foreman-mcp-server 授权问题漏洞 — Red Hat Satellite 6.18 | 7.8 | High | 2026-06-23 |
| CVE-2026-54320 | Daytona 授权问题漏洞 — daytona | 8.4 | High | 2026-06-23 |
| CVE-2026-52845 | caddyserver caddy 授权问题漏洞 — caddy | 8.1 | High | 2026-06-23 |
| CVE-2026-34917 | revive adserver 授权问题漏洞 — Adserver | - | - | 2026-06-23 |
| CVE-2026-44961 | revive adserver 授权问题漏洞 — Adserver | - | - | 2026-06-23 |
| CVE-2026-10845 | IBM Websphere Application Server 授权问题漏洞 — WebSphere Application Server | - | - | 2026-06-22 |
| CVE-2026-7664 | IBM Langflow OSS 授权问题漏洞 — Langflow OSS | 9.8 | Critical | 2026-06-22 |
| CVE-2026-12773 | LiteLLM 授权问题漏洞 — litellm | 7.3 | High | 2026-06-21 |
| CVE-2026-56345 | WWBN AVideo 授权问题漏洞 — AVideo | 8.1 | High | 2026-06-20 |
| CVE-2026-56294 | capacitor-native-biometric 授权问题漏洞 — capacitor-native-biometric | 4.8 | Medium | 2026-06-20 |
| CVE-2026-56080 | Capgo 授权问题漏洞 — capgo | 4.9 | Medium | 2026-06-19 |
| CVE-2026-45480 | Microsoft Azure Active Directory 授权问题漏洞 — Azure Active Directory | 10.0 | Critical | 2026-06-19 |
| CVE-2026-50559 | quarkusio Quarkus 授权问题漏洞 — quarkus | 7.5 | High | 2026-06-19 |
| CVE-2026-49872 | Apache APISIX 授权问题漏洞 — Apache APISIX | - | - | 2026-06-19 |
| CVE-2026-32174 | Microsoft Azure AI Bot Service 授权问题漏洞 — Azure AI Bot Service | 7.7 | High | 2026-06-18 |
| CVE-2026-49454 | szTheory relyra 授权问题漏洞 — relyra | 9.1 | Critical | 2026-06-18 |
| CVE-2026-11718 | Google MCP Toolbox for Databases (googleapis/mcp-toolbox) 授权问题漏洞 — MCP Toolbox for Databases (googleapis/mcp-toolbox) | - | - | 2026-06-18 |
| CVE-2026-11717 | Google MCP Toolbox for Databases (googleapis/mcp-toolbox) 授权问题漏洞 — MCP Toolbox for Databases (googleapis/mcp-toolbox) | - | - | 2026-06-18 |
| CVE-2026-48991 | XianYu Launcher 授权问题漏洞 — XianYuLauncher | 5.5 | Medium | 2026-06-17 |
| CVE-2026-32804 | Dell PowerFlex Manager 授权问题漏洞 — PowerFlex | 8.1 | High | 2026-06-17 |
| CVE-2026-49502 | Dell PowerFlex Manager 授权问题漏洞 — PowerFlex | 7.4 | High | 2026-06-17 |
| CVE-2026-48117 | fduflyer DroneAware Node 授权问题漏洞 — DroneAware-Node-Releases | 6.8 | Medium | 2026-06-17 |
CWE-287（认证机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1494 条 CVE 漏洞。