CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- go-vikunja vikunja Vikunja before 2.7.1 Missing Step-Up Authentication via TOTP Enrollment Endpoints 6.0 Medium
- openbmb internet of agents OpenBMB Internet of Agents Agent Registry app.py register missing authentication 6.9 Medium
- ibm api connect Multiple Vulnerabilities in IBM API Connect 8.3 High
- chartbrew Chartbrew: Unauthenticated BullMQ Admin Dashboard Exposure in Chartbrew 9.3 Critical
- evalstate fast-agent fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command execution 6.4 Medium
- kunchenguid lavish-axi Lavish: DNS rebinding allows any website to read arbitrary local files and inject prompts into the AI agent via the unauthenticated local server 8.1 High
- cilium tetragon Tetragon: Unauthenticated Tetragon gRPC admin API accessible from hostNetwork pods 8.8 High
- zhimaai chatwiki ChatWiki before 2.10.0 Unauthenticated Document Disclosure via getLibRawFileOnePage 8.7 High
- hisense vidaa Hisense VIDAA Smart TV UPnP/DLNA Missing Authentication 4.8 Medium
- hisense vidaa Hisense VIDAA Smart TV SSRF via SetAVTransportURI CurrentURI 4.8 Medium
- hisense vidaa Hisense VIDAA Smart TV DIAL Service Unauthenticated Access 5.3 Medium
- hisense vidaa Hisense VIDAA Smart TV Unauthenticated WebDriver Remote Access 8.7 High
- skyline communications dataminer Skyline DataMiner BrokerGateway Embedded API Key Authentication Bypass 8.7 High
- jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC... 6.7 Medium
- jetbrains clion In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to... 5.0 Medium
- flexera flexnet beacon, flexnet manager suite +1 more FlexNet Beacon Missing Authentication Vulnerability 6.9 Medium
- tpc software matchpoint Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint 8.7 High
- open-emr openemr OpenEMR: Unauthenticated Information Disclosure in admin.php Exposes Database Names and Versions 5.3 Medium
- libnoname noname noname v1.11.2 through v1.11.6.1 Missing Authentication in Electron Local File Server 7.7 High
- aozorae edgechat EdgeChat before 2.20.3 Missing Authentication for Attachment Download via GET /files/:key 6.3 Medium
- tinyhumansai openhuman OpenHuman: Unauthenticated dictation WebSocket allows arbitrary audio streaming and unbounded memory growth 7.7 High
- tinyhumansai openhuman OpenHuman: Unauthenticated Socket.IO RPC bypass allows invoking protected OpenHuman core controllers without the Bearer token 8.4 High
- tinyhumansai openhuman OpenHuman: Unauthenticated server-sent events endpoint leaks user-facing event data 6.2 Medium
- rapid7 metasploit framework Rapid7 Metasploit Framework Web Service unauthenticated bootstrap window allows creation of an administrator account without authentication 7.3 High
- openbmb internet of agents OpenBMB Internet of Agents WebSocket Connection Manager app.py ConnectionManager.connect missing authentication 6.9 Medium
- apache software foundation ofbiz Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation No score
- agentscope-ai agentscope agentscope-ai AgentScope Agent Service deps.py get_current_user_id missing authentication 6.9 Medium
- openhands OpenHands Landing missing authentication 5.3 Medium
- cisco telepresence Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets 8.5 High
- linksys e5350 Linksys E5350 Setup Wizard apply.cgi save_settings missing authentication 10.0 Critical
- deepseek-ai deepseek-harness DeepSeek Harness Unauthenticated RPC Command Execution 8.6 High
- yezhihao jt808-server yezhihao jt808-server Web Management API WebMvcConfig.addInterceptors missing authentication 6.9 Medium
- sharpemu SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process execution 8.3 High
- watchguard authpoint authentication gateway WatchGuard AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of Service 9.2 Critical
- about time technologies herowatch mini About Time Technologies｜Herowatch Mini - Missing Authentication 8.7 High
- quest foglight for databases Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability 9.8 Critical
- emerson ovation Emerson Ovation Missing Authentication for Critical Functionality 9.3 Critical
- nocodb NocoDB 0.300.0 before 2026.08.0 Unauthenticated OAuth Authorization Code Creation 6.9 Medium
- yeti-platform yeti Yeti: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence Data 7.5 High
-
github.com/basekick-labs/arcGo Arc has unauthenticated application log disclosure via `/api/v1/logs` No score - wppconnect wppconnect-server WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwoot 8.2 High
- drizzletime foxel Foxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumb 8.7 High
- padloc Padloc through 4.3.0 Missing SCIM Token Validation via SCIM GET Requests 6.3 Medium
- nexbox a95x Nexbox A95X Amlogic S905X UART Unauthenticated Console Access 7.0 High
- petpooja munshi Munshi Payment Bypass via Unauthenticated Webhook Endpoint 8.7 High
- suse rancher Privilege escalation in downstream clusters via GlobalRole inheritedNamespacedRules 7.2 High
- control web panel web panel Control Web Panel (CWP) < 1.29 Unauthenticated Loopback API Root Access 8.5 High
- madong-code madong-admin-saas madong-admin-saas through 5.1.4 Missing Authentication via Platform Tenant Management API 8.8 High
- jovancoding network-ai Network-AI 5.14.0 before 5.15.5 Missing Authentication in A2AServer Task Operations 6.9 Medium
- wavlink wn536ax6-a WAVLINK WN536AX6-A VPN Client List ioos sub_41a7c0 missing authentication 6.9 Medium
- Show olderLoading…