CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- nhost cli, nhost +1 moreNhost CLI MCP Server: Missing Inbound Authentication on Explicitly Bound Network Port7.7 High
- fastgptFastGPT: Unauthenticated SSRF via httpTools Endpoint Leads to Internal API Key Theft10.0 Critical
- 0xjacky nginx-ui, nginxui nginx ui +1 moreNginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover9.8 Critical
- zte zxhn h188a firmwareUnauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and...7.1 High
- promtengineer localgptPromtEngineer localGPT API Endpoint server.py LocalGPTHandler missing authentication6.9 Medium
- sippSIPP 3.3 Stack-Based Buffer Overflow via Configuration File8.6 High
- pms, kimtore practical music search +1 morePMS 0.42 Stack-Based Buffer Overflow via Configuration File8.6 High
- appsmithAppsmith < 1.98 Unauthenticated Instance Configuration Disclosure via Management APIs6.9 Medium
- openbmb xagentOpenBMB XAgent ShareServer WebSocket Endpoint share.py check_user missing authentication6.9 Medium
- buffalo inc. wi-fi router products, buffalo fs-m1266 firmware, fs-s1266 firmware +44 more +46 moreMissing authentication for critical function vulnerability in BUFFALO Wi-Fi router products may...6.9 Medium
- vienna symphonic library gmbh assistantMissing XPC Client & NSXPC endpoint validation leads to privilege escalation in Vienna Assistant (MacOS) - Vienna Symphonic Library8.8 High
@grackle-ai/powerlinenpm@grackle-ai/powerline Runs Without Authentication by Default6.3 Medium- gitlabMissing Authentication for Critical Function in GitLab6.8 Medium
- sharp corporation 5g mobile router sh-u01, home 5g hr01, home 5g hr02 +5 more +7 moreSHARP routers do not perform authentication for some web APIs. The device information may be...6.9 Medium
- pharos controls mosaic show controllerMissing Authentication for Critical Function in Pharos Controls Mosaic Show Controller9.3 Critical
- craftcms cms, craft cms +1 moreCraft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users6.9 Medium
- parisneo lollms-webui, lollms web ui +1 moreLoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpoint9.1 Critical
- dulldusk phpfilemanagerphpFileManager 1.7.8 Local File Inclusion via index.php6.9 Medium
- knime business hubAuth bypass in Apache Artemis allows reading all internal messages5.3 Medium
- galaxy software services vitals esp, gss vitalsesp +1 moreGalaxy Software Services｜Vitals ESP - Missing Authentication8.7 High
- wwbn avideoAVideo Vulnerable to Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment in status.json.php8.6 High
- tp-link archer nx200 firmware, archer nx210 firmware, archer nx500 firmware +12 more +14 moreAuthorization Bypass in HTTP Server Endpoints on TP-Link Archer NX200, NX210, NX500 and NX6008.6 High
- nexxt solutions nebula 300+ / tenda f3 v2.0 firmwareUnauthenticated Credential Disclosure via /goform/ate in Nexxt Nebula 300+7.1 High
- shenzhen hcc technology mpos m6 plusShenzhen HCC Technology MPOS M6 PLUS Bluetooth missing authentication2.3 Low
- No product listedMacCMS Timming API Endpoint Timming.php weak authentication6.9 Medium
- omnipemf neorhythmOmniPEMF NeoRhythm BLE missing authentication2.3 Low
- memuplay memu play, microvirt memu +1 moreMemu Play 6.0.7 Privilege Escalation via Insecure File Permissions9.3 Critical
- igl eparking.fiIGL-Technologies eParking.fi Missing Authentication for Critical Function9.3 Critical
- ctek chargeportal, charge portal +1 moreCTEK Chargeportal Missing Authentication for Critical Function9.3 Critical
- qnap qvr proQVR Pro9.3 Critical
- error311 fileriseFileRise has Unauthenticated Share Link Deletion3.7 Low
- yi technology home cameraYi Technology YI Home Camera CGI Endpoint ipc missing authentication5.3 Medium
- oracle identity manager, web services manager +1 moreVulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST...9.8 Critical
- apereo xerte online toolkits, xerte online toolkits +1 moreXerte Online Toolkits <= 3.14 Unauthenticated Template Import Arbitrary File Upload Leading to Remote Code Execution9.3 Critical
- spring boot, vmware spring boot +1 moreAuthentication Bypass under Actuator Health groups paths8.2 High
- bmc footprintsBMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication Bypass6.9 Medium
mcp-bridgenpmMCP Connect has unauthenticated remote OS command execution via /bridge endpoint9.8 Critical- avideoAVideo - Unauthenticated PGP Message Decryption via decryptMessage.json.php Endpoint6.9 Medium
- nltk, red hat lightspeed core, openshift lightspeed +4 more +6 moreNLTK has unauthenticated remote shutdown in nltk.app.wordnet_app7.5 High
- b3log siyuanSiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass7.5 High
- arturia software centerInsufficient XPC Client validation leading to local privilege escalation in Arturia Software Center7.8 High
- red hat build of keycloak 26.2, build of keycloak 26.2.14, build of keycloak 26.4 +2 more +4 moreKeycloak: keycloak: unauthorized authentication via disabled saml identity provider8.1 High
- cloudfoundry cloud foundryCloud Foundry unprotected internal endpoints7.5 High
- ibm sterling b2b integrator, sterling file gateway +1 moreIBM Sterling B2B Integrator and IBM Sterling File Gateway Improper Access Controls7.1 High
- langflowLangflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint9.3 Critical
- wwbn avideoAVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments8.1 High
- tibco bpm enterpriseTIBCO BPM Enterprise Remote Code Execution (RCE) Vulnerability8.7 High
- angeet es3 kvm, es3 kvm firmware +1 moreAngeet ES3 KVM unauthenticated arbitrary file write9.3 Critical
- sipeed nanokvmSipeed NanoKVM unauthenticated Wi-Fi configuration endpoint8.8 High
- gl-inet comet kvm, comet gl-rm1 firmware +1 moreGL-iNet Comet (GL-RM1) KVM unauthenticated root access via UART serial console7.0 High
- Show moreLoading…