CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- cgm clininetLack of API authentication allowing session generation for any user9.0 Critical
- microchip timepictraTimePictra Authentication Bypass Vulnerability9.3 Critical
- cern indicoIndico missing access check in event series management API6.5 Medium
- vivo health, health module +1 moreInsufficient protection mechanisms in the Health Module may lead to partial information disclosure.5.1 Medium
- vivo smartremote, smartremote module +1 moreThe SmartRemote module has insufficient restrictions on loading URLs, which may lead to some...7.1 High
- mobility46 mobility46.seMobility46 mobility46.se Missing Authentication for Critical Function9.3 Critical
- ev energy ev.energyEV Energy ev.energy Missing Authentication for Critical Function9.3 Critical
- switch ev swtchenergy.comSWITCH EV swtchenergy.com Missing Authentication for Critical Function9.3 Critical
- ev2go ev2go.ioEV2GO ev2go.io Missing Authentication for Critical Function9.3 Critical
- cloudcharge cloudcharge.seCloudCharge cloudcharge.se Missing Authentication for Critical Function9.3 Critical
- chargemap chargemap.comChargemap chargemap.com Missing Authentication for Critical Function9.3 Critical
- umbraco umbraco.engage.formsUmbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints7.5 High
- volcengine openvikingOpenViking Missing root_api_key Allows Anonymous ROOT Access9.3 Critical
- unitree go2 firmware, unitreerobotics unitree go2, unitree go2 edu firmware +2 moreUnitree Go2 Missing DDS Authentication Enables Adjacent RCE8.5 High
- fleetdm fleetFleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint1.7 Low
- chia blockchainChia Blockchain RPC Server Master Passphrase get_private_key missing authentication2.0 Low
- chia blockchainChia Blockchain RPC Credential rpc_server_base.py _authenticate improper authentication6.3 Medium
- linksys mr9600, mx4200 +1 moreMissing authentication in Linksys MR9600, Linksys MX42006.2 Medium
- epati antikor next generation firewall, epati cyber security technologies inc. antikor next generation firewall (ngfw) +1 moreAuthentication Bypass in ePati's Antikor NGFW9.8 Critical
- parseplatform parse dashboard, parse-community parse-dashboard +1 moreParse Dashboard has incomplete authentication on AI Agent endpoint9.9 Critical
- tattile s.r.l. smart+, tattile anpr mobile firmware, axle counter firmware +17 more +19 moreTattile Smart+ / Vega / Basic <= 1.181.5 Unauthenticated RTSP Stream Disclosure8.7 High
- actualbudget actualActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints9.2 Critical
- slican ipl, ipm, ipu +5 more +7 morePHP Function Injection in Slican NPC/IPL/IPM/IPU9.3 Critical
- datalinkdc dinkyDataLinkDC dinky OpenAPI Endpoint AppConfig.java addInterceptors missing authentication6.9 Medium
- roxnor elementskit elementor addons – advanced widgets & templates addons for elementorElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST Endpoint9.3 Critical
- frappe erpnextERP: Document access through endpoints due to missing validation9.3 Critical
- anyscale rayRay: Dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)5.9 Medium
- welker odoreyes ecosystem pulse bypass system with xl4 controllerWelker OdorEyes EcoSystem Pulse Bypass System with XL4 Controller Missing Authentication for Critical Function8.2 High
- jinan usr iot technology limited (pusr) usr-w610Jinan USR IOT Technology Limited (PUSR) USR-W610 Missing Authentication for Critical Function7.5 High
- acronis cyber protect 15, cyber protect 16, cyber protect cloud agent +2 moreSensitive data disclosure and manipulation due to missing authentication. The following products...9.8 Critical
github.com/dagu-org/daguGoDagu affected by unauthenticated RCE via inline DAG spec in default configuration9.8 Critical- inrove software and internet services bieticaret cmsAuthentication Bypass with Redirect in BiEticaret Software's BiEticaret CMS9.8 Critical
- razorpay for woocommerceRazorpay for WooCommerce <= 4.7.8 - Missing Authentication to Unauthenticated Order Modification5.3 Medium
- saturnremote saturn remote mouse serverSaturn Remote Mouse Server UDP Command Injection RCE8.6 High
- openclawOpenClaw 2026.1.29-beta.1 < 2026.2.14 - Authentication Bypass in Sandbox Browser Bridge Server8.5 High
- openclawOpenClaw < 2026.2.14 - Webhook Signature Verification Bypass via ngrok Loopback Compatibility6.3 Medium
- projectworlds online time table generatorMissing authentication in /admin/student.php and /admin/teacher.php in ProjectWorlds Online Time...7.5 High
- projectworlds online time table generatorMissing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds...9.1 Critical
- oretnom23 customer support systemSourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in...9.4 Critical
- honeywell 25m ipc, i-hib2pi-ul 2mp ip, ptz wdr 2mp 32m +1 more +3 moreHoneywell CCTV Products Missing Authentication for Critical Function9.3 Critical
- openclawOpenClaw has Missing Webhook Authentication in Telnyx Provider Allowing Unauthenticated Requests7.5 High
- openclawOpenClaw < 2026.2.12 - Unauthenticated Profile Tampering via Nostr Plugin HTTP Endpoints8.3 High
- openclawOpenClaw < 2026.2.12 - Webhook Authentication Bypass via Loopback remoteAddress Trust8.2 High
- openclawOpenClaw 2026.1.20 < 2026.2.1 - Missing Authentication in Browser Relay /cdp WebSocket Endpoint7.4 High
- openclawOpenClaw < 2026.2.2 - Device Identity Check Bypass in Gateway WebSocket Connect Handshake9.2 Critical
- tubitak bilgem software technologies research institute liderahenkImproper Access Control in TUBITAK BILGEM's Liderahenk6.1 Medium
- hkuds nanobotNanobot Unauthenticated WhatsApp Session Hijack via WebSocket Bridge10.0 Critical
- bosch infotainment system ecuEnabling SSH server on Infotainment ECU6.8 Medium
- amentotechpvtltd one to one user chat by wpguppyOne to one user Chat by WPGuppy <= 1.1.4 - Unauthenticated Information Disclosure via Chat Message Interception5.3 Medium
- calero verasmartCalero VeraSMART < 2022 R1 .NET Remoting Arbitrary File Read Leading to ViewState RCE10.0 Critical
- Show moreLoading…