目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-287 认证机制不恰当 类漏洞列表 1443

CWE-287 认证机制不恰当 类弱点 1443 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-287 属于身份验证缺陷漏洞，指系统在验证用户身份时未能充分核实其声明的真实性。攻击者常利用此弱点通过暴力破解、凭证填充或会话劫持等手段冒充合法用户，从而获取未授权访问权限。开发者应实施多因素认证、使用强哈希算法存储凭证、设置合理的账户锁定策略，并严格验证每次访问的身份凭证，以确保身份声明得到充分证明。

MITRE CWE 官方描述
CWE：CWE-287 Improper Authentication 英文：当某个actor声称具有某一特定身份时，产品未能证明或未能充分证明该声明是正确的。
常见影响 (1)
Integrity, Confidentiality, Availability, Access ControlRead Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands
This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.
缓解措施 (1)
Architecture and DesignUse an authentication framework or library such as the OWASP ESAPI Authentication feature.
代码示例 (2)
The following code intends to ensure that the user is already logged in. If not, the code performs authentication with the user-provided username and password. If successful, it sets the loggedin and user cookies to "remember" that the user has already logged in. Finally, the code performs administrator tasks if the logged-in user has the "Administrator" username, as recorded in the user cookie.
my $q = new CGI; if ($q->cookie('loggedin') ne "true") { if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("Error: you need to log in first"); } else { # Set loggedin and user cookies. $q->cookie( -name => 'loggedin', -value => 'true' ); $q->cookie( -name => 'user', -value => $q->param('username') ); } } if ($q->cookie('user') eq "Administrator") { DoAdministratorTasks(); }
Bad · Perl
GET /cgi-bin/vulnerable.cgi HTTP/1.1 Cookie: user=Administrator Cookie: loggedin=true [body of request]
Attack
In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts [REF-236]. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force attack by guessing a large number of common words. After gaining access as the member of the support st…
CVE ID标题CVSS风险等级Published
CVE-2026-73302 Budibase OIDC SSO账户接管漏洞 — budibase 9.0 Critical2026-08-13
CVE-2026-73840 OpenChoreo 未授权构建/工作流触发漏洞 — openchoreo 5.3 Medium2026-08-13
CVE-2026-17075 IBM i 数字证书管理器多个漏洞 — i 6.5 Medium2026-08-13
CVE-2026-17101 IBM Navigator for i 多个漏洞 — i 8.3 High2026-08-13
CVE-2026-17099 IBM i Navigator for i 存在多个漏洞 — i 7.3 High2026-08-13
CVE-2026-73655 Trigger.dev 通过跨提供商 OAuth 邮箱匹配在 Google 登录中的账户接管漏洞 — trigger.dev 7.4 High2026-08-13
CVE-2026-16867 IBM i NetServer 多个漏洞 — i 8.1 High2026-08-13
CVE-2026-17197 IBM i 主机服务器多个漏洞 — i 8.1 High2026-08-13
CVE-2026-59500 身份验证不当漏洞 — Portal Generator addon to Priority ERP (developed by Soft Solutions) 10.0 Critical2026-08-13
CVE-2026-47718 FUXA 安全模式下受保护读取API未授权访问漏洞 — FUXA 5.5 Medium2026-08-12
CVE-2026-73501 kin-openapi 默认认证绕过漏洞 — kin-openapi 9.1 Critical2026-08-12
CVE-2024-27253 IBM DOORS Next 审核删除请求漏洞 — DOORS Next 10.0 Critical2026-08-12
CVE-2026-12359 IBM Security Verify Access 远程代码执行漏洞 — Security Verify Access 8.1 High2026-08-12
CVE-2026-11923 IBM Verify Identity Access 和 IBM Security Verify Access 安全漏洞 — Security Verify Access 7.4 High2026-08-12
CVE-2026-42018 JFrog Artifactory 匿名用户令牌生成泄露漏洞 — artifactory 7.5 High2026-08-12
CVE-2026-68760 JFrog Artifactory 记住我认证绕过漏洞 — artifactory 5.3 Medium2026-08-12
CVE-2026-50561 Yuxi JWT认证绕过导致跨实例管理员令牌复用 — Yuxi 9.4 Critical2026-08-12
CVE-2026-26035 FortiWeb多版本认证绕过漏洞 — FortiWeb 8.8 Critical2026-08-12
CVE-2026-18961 WordPress VentraConnect 授权问题漏洞 — Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect 8.1 High2026-08-12
CVE-2026-73241 FreeRDP 授权问题漏洞 — FreeRDP 8.3 High2026-08-11
CVE-2026-71467 Redhat Advanced Cluster Management 授权问题漏洞 — Red Hat Advanced Cluster Management for Kubernetes 2 7.5 High2026-08-11
CVE-2026-62827 Microsoft SharePoint 授权问题漏洞 — Microsoft SharePoint Enterprise Server 2016 8.8 High2026-08-11
CVE-2026-12571 ZOHO ManageEngine DDI Central 授权问题漏洞 — manageengine_ddi_central 9.8 Critical2026-08-11
CVE-2026-73085 advplyr Audiobookshelf 授权问题漏洞 — audiobookshelf 5.3 Medium2026-08-11
CVE-2026-72922 AutoGPT 授权问题漏洞 — AutoGPT 8.2 High2026-08-11
CVE-2026-72533 Portainer Community Edition 授权问题漏洞 — Portainer CE 8.8 High2026-08-11
CVE-2026-19342 Code-Projects Task Management System 授权问题漏洞 — Task Management System 7.3 High2026-08-09
CVE-2026-48039 pipeboard-co Meta Ads MCP 授权问题漏洞 — meta-ads-mcp 9.1 Critical2026-08-07
CVE-2026-56793 Dell OpenManage Server Administrator 授权问题漏洞 — OpenManage Server Administrator Managed Node (Patch) for Windows 7.7 High2026-08-07
CVE-2026-56162 Microsoft Azure SQL Database 授权问题漏洞 — Azure SQL Database 10.0 Critical2026-08-06

CWE-287（认证机制不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1443 条 CVE 漏洞。