CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- fluent fluentdFluentd: Exposure of Sensitive Information via Monitor Agent API7.5 High
- fossbillingFOSSBilling: Unauthenticated update patcher endpoint allows remote maintenance execution6.9 Medium
- evoke csmsEVoke Systems EVoke CSMS Missing Authentication for Critical Function9.3 Critical
- filebrowserFile Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)9.3 Critical
- danny-avila librechatLibreChat: 2FA Backup Code Regeneration Without OTP Verification Allows 2FA Bypass5.9 Medium
- danny-avila librechatLibreChat: 2FA Re-enrollment Allows Full Account 2FA Takeover Without OTP Verification5.3 Medium
- hypr passwordlessMissing authentication for critical function vulnerability in HYPR Passwordless on Windows allows...6.7 Medium
- nlnet labs nsdBypass of client certificate verification with transfer over TLS8.2 High
- siyuan-note siyuanSiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon5.9 Medium
- fossbillingFOSSBilling: Authentication bypass allows unauthenticated administrator creation9.3 Critical
- hubbell aclara metrum cellular web interfaceMissing authentication for critical function in Hubbell Aclara Metrum Cellular Web Interface8.7 High
- mailerupUnauthenticated self-registration in MailerUp allows access to stored email data8.8 High
motioneyePyPImotionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE)9.8 Critical- tenable identity exposureInsecure Public Caching on REST API Endpoints in Tenable Identity Exposure8.5 High
- fossbillingFOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions10.0 Critical
- akin software computer import export industry and trade ltd. cafeplusRCE in Akınsoft's CafePlus8.8 High
- budibaseBudibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials7.4 High
- cap-go capgoCapgo - Missing Authentication Middleware on GET /private/role_bindings Endpoint6.9 Medium
- presire qsnapperInformation leak via “diff” methods in qSnapper6.9 Medium
- mattermost, mattermost server +1 moreMattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud install6.4 Medium
- cap-go capgoCapgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload Endpoint6.9 Medium
- berriai litellmBerriAI litellm SSO Debug Flow ui_sso.py json.dumps missing authentication6.9 Medium
- dbt-labs dbt-mcpdbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens6.8 Medium
- corewcfCoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade4.4 Medium
- home-assistant core, home-assistant +1 moreHome Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN7.6 High
- tilt-dev tiltTilt: Missing authentication on the network-exposed Tilt HUD server9.2 Critical
- ni grpc-device, instrumentstudio, grpc device server +2 moreInsecure Default Credentials vulnerability in NI grpc-device when TLS configuration is not present9.3 Critical
- dtwang line-desktop-mcpStreamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication8.8 High
- jetbrains hubIn JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430,...10.0 Critical
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection routes enables remote code execution9.5 Critical
- microsoft 365 copilotM365 Copilot Information Disclosure Vulnerability9.8 Critical
- startreedata mcp-pinotmcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind10.0 Critical
- agenticmail @agenticmail/claudecode, @agenticmail/codex, @agenticmail/core +1 more +3 moreAgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)8.2 High
- civilian board of contract appeals electronic docketing system (eds), government accountability office electronic protest docketing system (epds) +1 moreU.S. GAO EPDS and CBCA EDS unauthenticated password change9.3 Critical
- mervinpraison praisonaiPraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default7.5 High
- mervinpraison praisonaiPraisonAI MCPServer exposes unauthenticated HTTP tools/call9.8 Critical
- mervinpraison praisonaiPraisonAI AgentOS exposes unauthenticated agent listing and invocation9.4 Critical
- mervinpraison praisonaiPraisonAI UI MCP connect endpoint allows unauthenticated local command execution9.8 Critical
- mervinpraison praisonaiPraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation9.8 Critical
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints9.8 Critical
- mervinpraison praisonaipraisonai: Jobs API exposes agent-execution endpoints with no authentication9.8 Critical
- mervinpraison praisonaipraisonai: recipe serve auth middleware silently disables itself when no secret is set9.8 Critical
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass9.8 Critical
- mervinpraison praisonaiagentsPraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in9.8 Critical
- shenzhen liandian communication technology ltd v380 ip camera / appfhe1 v1.0.6.0A broken authorization boundary in the RTSP media delivery pipeline of Shenzhen Liandian...6.0 Medium
- mervinpraison praisonaiPraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing8.6 High
- mervinpraison praisonaiPraisonAI recipe serve Typer command bypasses the non-localhost authentication guard8.2 High
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools8.3 High
- mervinpraison praisonaiPraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint4.3 Medium
- jovancoding network-aiNetwork-AI: Empty default secret still authorizes all requests (Incomplete fix for CVE-2026-46701)9.1 Critical
- Show moreLoading…