CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- error311 fileriseFileRise: TOTP Bypass via Setup Endpoint Disclosing Existing Secret7.4 High
- dataojitori nocturne memoryEmpty API_TOKEN disables authentication on network-reachable HTTP/SSE transport8.7 High
- oviva-ag epa4all-clientepa4all-client: Unauthenticated REST API for Patient Record Writes6.5 Medium
- 1panel-dev maxkbMaxKB: Webhook Trigger Authentication Bypass7.5 High
- factionsecurity factionFaction: Unauthenticated Read, Modify, and Delete of Boilerplate Templates9.8 Critical
- kareadita kavitaKavita: No authentication at /api/Reader/image6.9 Medium
- pavel-odintsov fastnetmonFastNetMon Community Edition through 1.2.9 exposes a gRPC API server on port 50052 with no...8.1 High
- itzcrazykns vaneItzCrazyKns Vane API route.ts missing authentication6.3 Medium
- fissionFission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives8.8 High
- cursortouch windows-mcpWindows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS8.9 High
- altium 365Unauthenticated SOAP Endpoint in Altium 365 SearchService Allows Cross-Tenant Data Exfiltration and Index Destruction10.0 Critical
- taiko network communications pte ltd. ag1000-01a sms alert gatewayTaiko AG1000-01A Rev 7.3/8 Authentication Bypass via Web Interface9.3 Critical
- triliumnext triliumTrilium Notes: Authentication Bypass in Clipper API for Electron (Desktop) Builds8.6 High
- cisco secure workloadCisco Secure Workload Unauthorized API Access Vulnerability10.0 Critical
camofox-mcpnpmCamoFox MCP: Unauthenticated HTTP MCP browser-control surface7.0 High- decolua 9router9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes10.0 Critical
- kopiaKopia: Unauthenticated RCE via SSH ProxyCommand Injection when --insecure --without-password is used9.8 Critical
- scadabrMissing authentication for critical function in ScadaBR8.8 High
github.com/xyproto/algernonGoAlgernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication5.3 Medium- mozilla firefox, firefox for ios +1 moreSensitive user data could be leaked to other applications through Reader mode6.5 Medium
- No product listedAPI endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication...9.1 Critical
- datanoisetv tinyiceTinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection8.2 High
- markmhendrickson neotomaNeotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass6.9 Medium
- peugeot-music-plugin peugeot musicWordPress Plugin Peugeot Music 1.0 Arbitrary File Upload9.3 Critical
- gitbucketGitBucket 4.23.1 Unauthenticated Remote Code Execution9.3 Critical
- sanluan publiccmsSanluan PublicCMS Trade Address Query TradeAddressListDirective.java execute missing authentication6.9 Medium
- wwbn avideoWWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA5.7 Medium
- hashgraph guardianHedera Guardian Authentication Bypass Information Disclosure6.9 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Unauthenticated RAG Configuration Disclosure5.3 Medium
- wavelens gradientGradient: Unauthenticated worker on /proto → arbitrary NAR write / cache poisoning9.4 Critical
- amd athlon™ 3000 series mobile processors with radeon™ graphics, device management portal (admp), ryzen™ 3000 series desktop processors +23 more +25 moreMissing authentication in the KVM key download endpoint could allow an unauthenticated attacker...6.3 Medium
- palo alto networks prisma access agentPrisma Access Agent Endpoint DLP: Authorization Bypass Vulnerabilities5.9 Medium
- intranda goobi-viewer-coreGoobi viewer: Unauthenticated Solr Streaming Expression Proxy9.8 Critical
- garmin empirbus wireless display unit firmwareThe locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its authentication to...7.3 High
- sillytavernSillyTavern: Authentication Bypass via SSO Header Injection9.8 Critical
- churchcrm crmChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege Escalation8.8 High
- gitlawb openclaudeOpenClaude: Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input9.3 Critical
- hahwul dalfoxDalfox: Unauthenticated Arbitrary File Create/Append via `output` Option in Dalfox Server Mode8.2 High
- hahwul dalfoxDalfox: Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in Dalfox Server Mode7.5 High
- hahwul dalfoxDalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode10.0 Critical
- code runner mcp server runner mcp serverRCE in Code Runner MCP Server8.7 High
- siemens simatic cn 4100, simatic cn 4100 firmware +1 moreA vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected...8.8 High
- mem0mem0 server lacks authentication and authorization controls for its memory creation API endpoint5.3 Medium
- mem0The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API...6.5 Medium
- mem0The mem0 1.0.0 server lacks authentication and authorization controls for its memory reset and...6.5 Medium
- mem0The mem0 v1.0.0 server lacks authentication and authorization controls for its memory reset...9.1 Critical
- mem0mem0 server lacks authentication and authorization controls for its memory deletion API endpoint6.5 Medium
mem0aiPyPImem0 server lacks authentication and authorization controls for its memory management API endpoints7.5 High- jetbrains teamcityIn JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to...8.2 High
- download-from-files download from filesWordPress Download From Files 1.48 Arbitrary File Upload9.3 Critical
- Show moreLoading…