CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
n8n-mcpnpmn8n-mcp has unauthenticated session termination and information disclosure in HTTP transport8.2 High- mauriceboe trekUnauthenticated Access to Uploaded Files in TREK3.7 Low
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions9.1 Critical
- egate atom 3x projectorSecurity Misconfiguration Vulnerability in Atom 3x Projector8.7 High
- 10ij dockyardDockyard's Unauthenticated Cron Endpoint in Dockyard Enables Container Enumeration and Database Manipulation6.5 Medium
- juniper junos os evolvedJunos OS Evolved: Local, authenticated attacker can gain privileged access to FPCs8.5 High
- mervinpraison praisonaiPraisonAI has an Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls7.9 High
- gpl odorizers gpl750 (xl7 prime), gpl750 (xl7), gpl750 (xl4 prime) +1 more +3 moreGPL Odorizers GPL750 Missing Authentication for Critical Function8.6 High
- coreweave marimomarimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass9.3 Critical
- juniper junos, juniper networks junos os +1 moreJunos OS: Privileged local user can gain access to a Linux-based FPC as root8.4 High
- kcpkcp's cache server is accessible without authentication or authorization checks8.2 High
- ci4-cms-erp ci4msPost-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms8.1 High
- coolercontrol coolercontroldMissing Authentication for Critical Function in coolercontrold5.9 Medium
- freescoutFreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumeration6.9 Medium
- weaver e-cologyWeaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint9.3 Critical
- linkwhisper link whisper, unknown link whisper free +1 moreLink Whisper Free < 0.9.1 - Unauthenticated Settings and User Meta Update6.5 Medium
- totolink a8000rTotolink A8000R cstecgi.cgi setLanguageCfg missing authentication6.9 Medium
- vitejs vite, red hat advanced cluster security 4, ansible automation platform 2 +13 more +15 moreVite Affected by Arbitrary File Read via Vite Dev Server WebSocket8.2 High
- strawberry graphql, strawberry-graphql strawberry +1 moreAuthentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocol7.5 High
- glpi-project glpiGLPI has an Unauthenticated Stored XSS via inventory7.5 High
- assafelovic gpt-researcherassafelovic gpt-researcher HTTP REST API Endpoint missing authentication6.9 Medium
- No product listedJeecgBoot AI Chat JeecgBizToolsProvider.java missing authentication6.9 Medium
- honeywell barcode scannersCVE-2026-4272 - Bluetooth Remote Execution of System Commands Vulnerability8.1 High
- coreftp core ftpCore FTP 2.0 build 653 PBSZ Unauthenticated Denial of Service8.7 High
- c4g basic laboratory information system, gatech computing for good\'s basic laboratory information system +1 moreC4G BLIS 3.4 SQL Injection via users_select.php8.8 High
- wikipediaWikipedia 12.0 Denial of Service via Search8.7 High
- vpnbrowser vpn browser+VPN Browser+ 1.1.0.0 Denial of Service8.7 High
- wwbn avideoWWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php5.3 Medium
- gardyn cloud apiGardyn Cloud API Missing Authentication for Critical Function9.2 Critical
- gardyn cloud apiGardyn Cloud API Missing Authentication for Critical Function6.9 Medium
- gardyn cloud apiGardyn Cloud API Missing Authentication for Critical Function8.7 High
- lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +1 more +3 moreMissing Authentication for Critical Function in mlflow/mlflow9.1 Critical
- microsoft azure web appsAzure MCP Server Information Disclosure Vulnerability9.1 Critical
- belden hios switch, hirschmann hios switch platform +1 moreHiOS Switch Platform Denial-of-Service via Web Interface9.2 Critical
- hackerbay oneuptimeOneUptime: Unauthenticated Workflow Execution via ManualAPI9.2 Critical
- hackerbay oneuptimeOneUptime: Missing Authentication on Notification Endpoints9.1 Critical
- signalk signal k server, signalk-server +1 moresignalk-server: Unauthenticated Source Priorities Manipulation6.9 Medium
- seppmail secure email gatewayESWmail-Verify Bypass6.3 Medium
- vanna-ai vannavanna-ai vanna Chat API Endpoint v2 missing authentication6.9 Medium
- hclsoftware bigfix platformHCL BigFix Platform is affected by insufficient authentication4.0 Medium
- mervinpraison praisonaiPraisonAI: Missing Authentication in WebSocket Gateway9.1 Critical
- fccview cronmastercronmaster: Middleware authentication bypass enabling unauthorized page access and server-action execution8.3 High
- volcengine openvikingOpenViking 0.2.5 < 0.2.14 Bot Proxy Endpoints Allow Unauthenticated Access6.9 Medium
- canonical jujuImproper TLS Client/Server authentication and certificate verification on Database Cluster10.0 Critical
- sagedpw sage dpwA non-default configuration in Sage DPW 2025_06_004 allows unauthenticated access to diagnostic...5.9 Medium
- wwbn avideoAVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints5.3 Medium
- wwbn avideoAVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php7.5 High
- px4 autopilotPX4 Autopilot Missing authentication for critical function9.3 Critical
- anritsu remote spectrum monitor ms27100a, remote spectrum monitor ms27101a, remote spectrum monitor ms27102a +1 more +3 moreMissing Authentication for Critical Function vulnerability in Anritsu Remote Spectrum Monitor9.3 Critical
- bishopfox sliverSliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface5.9 Medium
- Show moreLoading…