CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- opencatsOpenCATS 0.9.4 Remote Code Execution via Resume Upload9.3 Critical
- mstore apiWordPress MStore API 2.0.6 Arbitrary File Upload9.3 Critical
- ugreen cm933UGREEN CM933 Administrative missing authentication5.3 Medium
- yoda-digital mcp-gitlab-serverGitLab MCP Server: SSE transport has no authentication and wildcard CORS, exposing all GitLab tools9.2 Critical
- free5gcfree5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers10.0 Critical
- free5gcfree5GC: SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating8.2 High
- free5gcfree5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler10.0 Critical
- free5gcfree5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)7.5 High
- free5gcfree5GC: NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path7.3 High
- labring fastgptFastGPT: Unauthenticated Remote Code Execution (RCE) via code-server Misconfiguration in agent-sandbox9.8 Critical
- clineCline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability9.6 Critical
- erudika scooldScoold: Persistent Admin Takeover by Overwriting the admins Configuration Setting via Forged JWT (missing `jti` validation)6.7 Medium
gmaps-mcpPyPIgmaps-mcp's unauthenticated HTTP transport allows unlimited Google Maps API calls at operator expense8.3 High- mervinpraison praisonaiPraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution7.3 High
- lin-snow ech0Ech0 before 4.7.3 Unauthenticated Like Endpoint Metric Inflation6.9 Medium
- github enterprise serverAuthentication bypass vulnerability in GitHub Enterprise Server allowed creation of local user accounts bypassing the configured external identity provider6.3 Medium
- yarbo firmware, lawn mower firmware, lawn mower pro firmware +2 moreOpen MQTT orchestration without read/write ACLs in Yarbo robot firmware9.8 Critical
- givanz vvvebVvveb < 1.0.8.2 Hard-coded Credentials Information Disclosure via phpMyAdmin9.2 Critical
- picotronica e-clinic healthcare system echsPicoTronica e-Clinic Healthcare System ECHS API Endpoint patient-records missing authentication6.9 Medium
- devspaceDevSpace UI Server WebSocket CheckOrigin does not validate source7.7 High
- wwbn avideoWWBN AVideo: Unauthenticated User Enumeration in `objects/users.json.php` via `isCompany` Parameter Flips `$ignoreAdmin = true` and Defeats Admin-Only Listing Guard5.3 Medium
- ethyca fidesFides: Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection6.1 Medium
- manomanotech firefighter-incidentFireFighter: Unauthenticated SSRF in Raid jira_bot endpoint allows IAM credential theft9.9 Critical
- jovancoding network-aiNetwork-AI: Missing authentication on MCP HTTP endpoint allows unauthenticated privileged tool calls8.7 High
- chatchat-space langchain-chatchatchatchat-space Langchain-Chatchat Compatible File Service openai_routes.py delete_file missing authentication5.3 Medium
- eclipse equinox osgiEclipse Equinox OSGi 3.7.2 Remote Code Execution via Console9.3 Critical
- eclipse equinox osgiEclipse Equinox OSGi 3.8-3.18 Console Remote Code Execution9.3 Critical
- No product listedThe GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD...9.1 Critical
- pyload, pyload-ng project pyload-ng +1 morepyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification6.8 Medium
- phpvmsphpvms: /importer authorization bypass causing full database wipe9.4 Critical
- 0xjacky nginx-ui, nginxui nginx ui +1 morenginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover8.1 High
- 0xjacky nginx-ui, nginxui nginx ui +1 morenginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim8.1 High
- arelleArelle < 2.39.10 Unauthenticated RCE via /rest/configure9.2 Critical
- prefecthq prefectPrefectHQ prefect WebSocket Endpoint in missing authentication6.9 Medium
- crocodilestick calibre-web-automatedcrocodilestick Calibre-Web-Automated Admin Endpoint cwa_functions.py missing authentication6.9 Medium
- chartbrewUnauthenticated Account Registration via /user/invited Bypasses All Signup Restrictions in Chartbrew6.5 Medium
- pylixm django-mdeditordjango-mdeditor is Missing Authentication for Critical Function5.1 Medium
- sonicwall sonicosA vulnerability in the access control mechanism of SonicOS may allow certain management interface...8.0 High
- cpanel, cpanel whm, wp squared +1 more +3 moreWebPros cPanel and WHM Authentication Bypass via Login Flow9.3 Critical
- carlson software vasco-b gnss receiverCarlson Software VASCO-B GNSS Receiver Missing Authentication for Critical Function9.4 Critical
- cisco intersight device connector, nutanix cisco intersight device connector for prism central +1 moreCisco Intersight Device Connector for Nutanix Prism Central Unauthenticated API Access6.7 Medium
- vega vegapuls 6x firmware, vega grieshaber vegapuls 6x two-wire profinet, modbus tcp, opc ua (ethernet-apl) +1 moreVEGA: Privilege escalation through unsecured configuration interface in VEGAPULS devices7.5 High
- hanwha vision qnd-8080r, hanwhavision knb-2000 firmware, knb-5000n firmware +251 more +253 moreAuthentication Bypass8.7 High
- nousresearch hermes-agentNousResearch hermes-agent Webhooks Endpoint webhook.py missing authentication6.3 Medium
- 666ghj mirofish666ghj MiroFish REST API Endpoint __init__.py create_app missing authentication6.9 Medium
- cyberpanelCyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints8.8 High
- deskflowDeskflow: Local privilege escalation via unauthenticated IPC7.8 High
- traefik, red hat openshift dev spaces 3.28 +1 moreTraefik: Forwarded alias spoofing top pre-auth decision bypass7.8 High
- eclipse foundation kuksa - databrokerA client holding only a read JWT scope can still register itself as a signal provider through the...8.5 High
- senselive x3050SenseLive X3050 Missing authentication for critical function9.3 Critical
- Show moreLoading…