CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- uni-yaz flexcity, universal software inc. flexcity/kiosk +1 moreBusiness Logic Error in Universal Software's FlexCity/Kiosk8.8 High
- yokecd yokeUnauthenticated Admission Webhook Endpoints in Yoke ATC7.5 High
- albrecht jung gmbh & co. kg jung smart visu server, jung-group smart visu server firmware +1 moreJUNG Smart Visu Server 1.1.1050 - 'JUNG Smart Visu Server' Missing Authentication8.7 High
- scriptsbundle adforestAdForest <= 6.0.12 - Authentication Bypass9.8 Critical
- milvusMilvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise9.8 Critical
- zlan information technology co. zlan5143dZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function9.3 Critical
- zlan information technology co. zlan5143dZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function9.3 Critical
- metis cyberspace technology sa dfsUnauthenticated Remote Command Execution via Web Console in METIS DFS9.8 Critical
- metis cyberspace technology sa wicUnauthenticated Remote Root Shell Access via Web Console in METIS WIC9.8 Critical
- dinosoft business solutions erpImproper Access Control in Dinosoft Business Solutions' Dinosoft ERP9.8 Critical
- ivanti endpoint manager, endpoint manager (epm) +1 moreAn authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote...8.6 High
- frangoteam fuxaFUXA Unauthenticated Remote Code Execution in Node-RED Integration9.5 Critical
- polarlearnPolarLearn allows Unauthenticated WebSocket access allows subscribing to and posting in arbitrary group chats10.0 Critical
- friendsofshopware froshadminer, froshplatformadminer +1 moreFroshAdminer Adminer UI is accessible without admin session6.9 Medium
- jetbrains hubIn JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was...9.1 Critical
- hgiga c&cm@il package olln-baseHGiga｜C&Cm@il - Missing Authentication9.3 Critical
- cradle e-commercedetronetdip E-commerce Account Creation Endpoint add_seller.php missing authentication6.9 Medium
- dbpower c300 hd cameraDBPower C300 HD Camera - Remote Configuration Disclosure8.7 High
- ace security aptina ar0130 960p 1.3mp cameraAptina AR0130 960P 1.3MP Camera - Remote Configuration Disclosure8.7 High
- bishopfox sliverSliver has a DNS C2 OTP Bypass Allows Unauthenticated Session Flooding and Denial of Service7.5 High
- flycatcher toys smart pixelator, flycatcher smart pixelator firmware +1 moreFlycatcher Toys smART Pixelator Bluetooth Low Energy missing authentication5.3 Medium
- keylime, red hat enterprise linux 10, enterprise linux 10.0 extended update support +9 more +11 moreKeylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authentication9.4 Critical
- frangoteam fuxaFUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API9.5 Critical
- frangoteam fuxaFUXA Unauthenticated Exposure of Plaintext Database Credentials9.1 Critical
- openclawOpenClaw Affected by Unauthenticated Local RCE via WebSocket config.apply8.4 High
- synectix lan 232 trioSynectix LAN 232 TRIO Missing Authentication for Critical Function10.0 Critical
- riss srl moma seismic stationRISS SRL MOMA Seismic Station Missing Authentication for Critical Function9.3 Critical
- avation light engine proMissing Authentication for Critical Function in Avation Light Engine Pro9.3 Critical
- frangoteam fuxaFUXA contains an Unrestricted File Upload vulnerability9.8 Critical
- frangoteam fuxaFUXA contains an insecure default configuration vulnerability9.3 Critical
- nixos nixpkgsNixOs Odoo database and filestore publicly accessible with default odoo configuration9.1 Critical
- bambuddyBambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication9.8 Critical
- avibia avibialine avle1 hd 5.0, avibialine avle2 hd 5.0, avibialine avle4 hd 5.0 +27 more +29 moreMultiple Innomic VibroLine VLX HD 5.0 and avibia AVLX weak password requirements9.8 Critical
- avibia avibialine avle1 hd 5.0, avibialine avle2 hd 5.0, avibialine avle4 hd 5.0 +27 more +29 moreMultiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via CAN6.5 Medium
- avibia avibialine avle1 hd 5.0, avibialine avle2 hd 5.0, avibialine avle4 hd 5.0 +27 more +29 moreMultiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via Modbus (RS485)6.5 Medium
- avibia avibialine avle1 hd 5.0, avibialine avle2 hd 5.0, avibialine avle4 hd 5.0 +27 more +29 moreMultiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via Modbus (TCP)7.5 High
- avibia avibialine avle1 hd 5.0, avibialine avle2 hd 5.0, avibialine avle4 hd 5.0 +27 more +29 moreMultiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via HTTP7.5 High
- internet information co., ltd dreammakerInterinfo DreamMaker - Missing Authentication for Critical Function9.3 Critical
- runtipiRuntipi vulnerable to unauthenticated docker-compose.yml Overwrite via Path Traversal7.6 High
- kiloview encoder series e1 hardware version 1.4, encoder series e1 hardware version 1.6.20, encoder series e1-s hardware version 1.4 +7 more +9 moreMissing Authentication for Critical Function in KiloView Encoder Series9.3 Critical
- intelbras router rf 301kIntelbras Router RF 301K 1.1.2 - Authentication Bypass8.7 High
- pix-link lv-wr21q, wr21q +1 moreMissing Authentication for Critical Endpoint in Pix-Link LV-WR21Q6.9 Medium
- dormakaba access manager 92xx-k5, access manager 92xx-k7 +1 moreUnauthenticated SOAP API in dormakaba access manager9.3 Critical
- dormakaba kaba exos 9300Unauthenticated SOAP API in dormakaba Kaba exos 93009.3 Critical
- beetel 777vr1, 777vr1 firmware +1 moreBeetel 777VR1 UART missing authentication5.4 Medium
- smartertools smartermailSmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API9.3 Critical
- unified intents ab remoteUnified Remote 3.9.0.2463 - Remote Code Execution9.3 Critical
- jnc i6, iaqs +1 moreJNC｜IAQS and I6 - Missing Authentication9.3 Critical
- enel x juicebox 40Enel X JuiceBox 40 Telnet Service Missing Authentication Remote Code Execution Vulnerability8.8 High
- aptsys gemscms backendA vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which...9.4 Critical
- Show moreLoading…