CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- drangsoft gcb/fcb audit software, dragonsoft gcb\/fcb government financial cybersecurity configuration audit software +1 moreDrangSoft｜GCB/FCB Audit Software - Missing Authentication9.3 Critical
- samsung smart switchExposure of sensitive functionality to an unauthorized actor in Smart Switch prior to version 3.7...5.3 Medium
- telesquare sdt-cs3b1, sdt-cs3b1 firmware +1 moreTelesquare SKT LTE Router SDT-CS3B1 Unauthenticated Remote Reboot8.7 High
- tiandy easy7 integrated management platformTiandy Easy7 Integrated Management Platform Device Identifier UpdateLocalDevInfo.jsp missing authentication6.9 Medium
- serviio proServiio PRO 1.8 Unauthenticated Password Change via REST API8.7 High
- serviio proServiio PRO 1.8 REST API Information Disclosure8.7 High
- socomec diris a-40Socomec DIRIS A-40 HTTP API Authentication Bypass Vulnerability6.3 Medium
- philips hue bridge, hue bridge v2 firmware +1 morePhilips Hue Bridge HomeKit Accessory Protocol Transient Pairing Mode Authentication Bypass Vulnerability8.1 High
- parse-community parse-serverParse Server GraphQL WebSocket endpoint bypasses security middleware6.9 Medium
- danny-avila librechatLibreChat MCP OAuth callback does not validate browser session — allows token theft via redirect link7.6 High
- daguDagu SSE Authentication Bypass in Basic Auth Mode7.5 High
- abb awin gw100 rev.2, awin gw120 +1 moreConfiguration Data Spill7.2 High
- abb awin gw100 rev.2, awin gw120 +1 moreDevice Reboot Control7.1 High
- vivo easyshareThe authentication mechanism for a specific feature in the EasyShare module contains a...6.9 Medium
- voltronic power snmp web pro, gvectors wpdiscuz +1 moreVoltronic Power SNMP Web Pro 1.1 Authentication Bypass via localStorage8.8 High
- honeywell iq3, iq412, iq412 firmware +9 more +11 moreHoneywell IQ4x BMS Controller Missing authentication for critical function10.0 Critical
zeptoclawcrates.ioZeptoClaw: Email Sender Spoofing to bypass Header-Only From Allowlist Validation6.5 Medium- qhkm zeptoclawZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload data8.2 High
- runtipiRuntipi unauthenticated /api/auth/reset-password allows operator account takeover during active reset window7.7 High
- comtrend ar-5310Comtrend AR-5310 GE31-412SSG-C01_R10.A2pG039u.d24k Restricted Shell Escape8.6 High
- wanderingastronomer vociferousVociferous Unauthenticated Remote Path Traversal (RCE via CSRF)10.0 Critical
- argoproj argo workflows, argo-workflows, red hat openshift ai (rhoai) +1 more +3 moreArgo Workflows has unauthorized access to Argo Workflows Template9.8 Critical
- microsoft azure iot explorerAzure IoT Explorer Information Disclosure Vulnerability7.5 High
- tubitak bilgem software technologies research institute liderahenkRCE in TUBITAK BILGEM's Liderahenk7.5 High
- arraytics booktics – booking calendar for appointments and service businessesBooktics <= 1.0.16 - Missing Authorization to Addon Plugin Installation5.3 Medium
- arraytics booktics – booking calendar for appointments and service businessesBooktics <= 1.0.16 - Missing Authorization to Get Items via REST API endpoints5.3 Medium
github.com/shi-gg/linkdaveGoLinkdave Missing Authentication on REST and WebSocket endpoints9.3 Critical- filebrowserFileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info7.5 High
- wwbn avideoWWBN AVideo - Unauthenticated IDOR - Playlist Information Disclosure5.5 Medium
- anhui seeker electronic technology co., ltd. xikestor sks8310-8x, seekswan zikestor sks8310-8x firmware +1 moreXikeStor SKS8310-8X switch_config.src Missing Authentication8.7 High
- flowiseai flowiseFlowise: Missing Authentication on NVIDIA NIM Endpoints7.7 High
- wekanWekan Exposes All Global Webhook Integrations through globalwebhooks Publication8.7 High
- everon api.everon.ioEveron api.everon.io Missing Authentication for Critical Function9.3 Critical
- navtor navbox, navbox firmware +1 moreNavtor NavBox exposes sensitive configuration and operational data due to missing authentication...7.5 High
- mobiliti e-mobi.hu, mvm mobiliti e-mobi.hu +1 moreMobiliti e-mobi.hu Missing Authentication for Critical Function9.3 Critical
- chartbrewChartbrew: Unauthenticated Chart Filter Endpoint: POST /project/:project_id/chart/:chart_id/filter missing verifyToken + checkPermissions8.7 High
- epower epower.ieePower epower.ie Missing Authentication for Critical Function9.3 Critical
- microsoft payment orchestrator servicePayment Orchestrator Service Elevation of Privilege Vulnerability8.6 High
- openclawOpenClaw 2026.1.5 < 2026.2.12 - Missing Authentication in Browser Control HTTP Endpoints7.5 High
- nginxui nginx ui, 0xjacky nginx-ui +1 moreNginx UI: Unauthenticated Backup Download with Encryption Key Disclosure9.8 Critical
- seiko epson corporation esc/pos, epson sb-h50 firmware, tm-h6000v firmware +22 more +24 moreESC/POS, a printer control language designed by Seiko Epson Corporation, lacks mechanisms for...9.8 Critical
- ceriumsoft ajax dashboardAJAX Dashboard - Critical - Access bypass - SA-CONTRIB-2026-0226.5 Medium
- apache artemis, apache software foundation activemq artemis, red hat amq broker 7.12.6 +17 more +19 moreApache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation9.3 Critical
- openclawOpenClaw < 2026.2.22 - Gateway Token Disclosure via Chrome CDP Probe5.9 Medium
openclawnpmOpenClaw has auth inconsistency on local Browser Extension Relay /extension endpoint5.1 Medium- openclawOpenClaw < 2026.2.21 - Unauthenticated Webhook Access via Passwordless Fallback in BlueBubbles Plugin6.3 Medium
- labkotec lid-3300ip, lid-3300ip type 2 +1 moreMissing Authentication for Critical Function in Labkotec LID-3300IP8.8 High
- openclawOpenClaw < 2026.2.21 - Missing VNC Authentication in Sandbox Browser noVNC Observer8.5 High
- devcode openstamanagerUnauthenticated privilege escalation in OpenSTAManager via modules/utenti/actions.php9.8 Critical
- openclawOpenClaw < 2026.3.1 - Unauthenticated Browser Control Access via Failed Auth Bootstrap7.5 High
- Show moreLoading…