CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- red hat logging subsystem for red hat openshift, multicluster engine for kubernetes, multicluster engine for kubernetes 2.1 +17 more +19 moreHypershift: konnectivity proxy-server accepts agent connections without validating client certificates9.4 Critical
- newpanjing simpleuinewpanjing simpleui AjaxAdmin AJAX Endpoint admin.py self.get_action missing authentication6.9 Medium
- gerapyGerapy Project Upload Endpoint views.py missing authentication6.9 Medium
- zalando skipperSkipper routesrv-no-auth: All routesrv API Endpoints Lack Authentication5.7 Medium
- ibm langflow oss, langflow +1 moreAuthentication Bypass in Webhook Endpoints Allowed Unauthorized Flow Execution9.8 Critical
- ibm langflow oss, langflow +1 moreUnauthenticated Superuser Token Issuance via Auto-Login Endpoint9.8 Critical
- ibm langflow oss, langflow +1 moreUnauthenticated User Registration Could Lead to Remote Code Execution9.8 Critical
- vimesoft inc. enterprise video platformAuthentication Bypass in Vimesoft's Enterprise Video Platform7.5 High
- fossasia open-event-serverOpen Event Server 1.19.1 Unauthenticated Member Roster Export via CSV Export Endpoint8.7 High
- strangebee thehiveTheHive 4.1.24 Unauthenticated Information Disclosure via /api/status Endpoint6.9 Medium
- poco-ai poco-clawpoco-ai poco-claw executor_manager API tasks.py create_task missing authentication5.3 Medium
- mohibshaikh clawvetclawvet < 0.7.5 Hard-coded JWT Secret Session Forgery9.3 Critical
- envoyproxy gatewayEnvoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode7.4 High
- lenovo smart connectDuring an internal security assessment, a potential improper access control vulnerability was...6.8 Medium
- grafana oncallGrafana OnCall 1.16.11 Unauthenticated Token Hijack via Plugin Install Endpoint9.3 Critical
- microsoft simplechatSimpleChat plugin validation endpoints missing authentication and authorization8.6 High
- No product listedEQ-3 Eqiva CC-RT-BLE Bluetooth Smart Radiator Thermostat Firmware up to the latest version 1.46...7.1 High
- andrea9293 mcp-documentation-serverMCP Documentation Server: Web UI API binds to all interfaces without authentication by default8.8 High
- gpustackGPUStack Unauthenticated Information Disclosure via Worker Endpoints8.8 High
- cursorCursor: Cloud Agent Browser Sandbox Escape7.7 High
- mervinpraison praisonaiPraisonAI before 4.6.78 Missing Webhook Signature Verification8.8 High
- mervinpraison praisonaiPraisonAI before 4.6.78 Authentication Bypass via Host Header Spoofing8.8 High
- mervinpraison praisonaiPraisonAI before 4.6.78 Authentication Bypass via HTTP-stream6.9 Medium
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Missing Authentication for Critical Function (CWE-306)9.3 Critical
- labs64 netlicensing-mcpNetLicensing MCP Server: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode8.1 High
- nvidia tensorrt-llmNVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause missing...6.4 Medium
- nvidia tensorrt-llmNVIDIA TensorRT-LLM for Linux contains a vulnerability in the disaggregated orchestrator...7.3 High
- adobe experience manager, experience manager 6.5, experience manager 6.5 lts +1 more +3 moreAdobe Experience Manager | Missing Authentication for Critical Function (CWE-306)8.6 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2012 +12 more +14 moreWindows Server Update Service (WSUS) Elevation of Privilege Vulnerability8.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWindows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability7.1 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +18 more +20 moreWindows Spaceport.sys Elevation of Privilege Vulnerability7.8 High
- microsoft azure cyclecloud, azure cyclecloud 8.9.1 +1 moreAzure CycleCloud Elevation of Privilege Vulnerability8.8 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Elevation of Privilege Vulnerability5.3 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +14 more +16 moreDNS Client Tampering Vulnerability6.1 Medium
- rockwell auotmation 1715 ethernet/ip communications moduleRockwell Automation 1715 Redundant IO – Access Control Vulnerability10.0 Critical
- jetbrains youtrackIn JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3...10.0 Critical
- apache dorisApache Doris: Improper Authentication in Frontend HTTP API9.1 Critical
- sap se @ui5/webcomponents-baseAllowlist Bypass in setThemeRoot() Enables Cross-Origin CSS Injection6.1 Medium
- red hat openshift gitops, argoproj argo-helm, red hat openshift data foundation 4 +1 more +3 moreArgo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint8.9 High
- argoproj argo-helmArgo CD Helm Chart < 10.0.0 Missing Network Policy RCE8.6 High
- 4real themisnetpanelUnauthenticated Remote Code Execution in ThemisNETPanel9.3 Critical
- evbee dc-80Missing authentication for webserver endpoints9.3 Critical
- rafymrx toko-online-rotiRafyMrX TOKO-ONLINE-ROTI missing authentication6.9 Medium
- mervinpraison praisonaiPraisonAI before 1.7.3 Unauthenticated Agent Access via Insecure Defaults8.8 High
clausterPyPIClauster: Non-loopback deployments can serve the dashboard unauthenticated when auth.enabled is unset8.7 High- deloitte ai assist for customerDeloitte AI Assist for Customer unauthenticated RAG corpus read and write6.3 Medium
- deloitte ai assist for customerDeloitte AI Assist for Customer unauthenticated configuration write6.9 Medium
- decolua 9router9router: Reverse proxy locality collapse allows unauthenticated access to 9router /v1 APIs8.3 High
- st engineering idirect 3315-series terminals, 9-series terminals, evolution iq‑series terminals +2 moreST Engineering iDirect iQ-Series Terminals Missing authentication for critical function8.7 High
- mervinpraison praisonaiPraisonAI before 4.6.78 Unauthenticated SSRF via webhook_url6.9 Medium
- Show moreLoading…