CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- chaskiqChaskiq Chaskiq - Missing Authentication8.2 High
- red hat fuse 7, jboss enterprise application platform 7, jboss enterprise application platform 7.4 els on rhel 7 +11 more +13 moreWildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos7.4 High
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.3 +1 more +3 moreFeast: feast-operator: feast: default authentication mode is no_auth — shared multi-tenant instances deployed without authentication7.7 High
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +1 more +3 moreTrustyai-service-operator: trustyai-service-operator: tas internal service bypasses kube-rbac-proxy, exposing unauthenticated quarkus api cluster-wide8.0 High
- tbea tlogger (tbea communication box 3rd generation)Multiple Unauthenticated Denial-of-Service Conditions8.8 High
- tbea tlogger (tbea communication box 3rd generation)Insufficient Webserver Authentication9.2 Critical
- dokployDokploy: Unauthenticated Git Provider Injection via GitHub OAuth Callback7.5 High
- opensignlabs opensignserverOpenSignLabs opensignserver - Missing Authentication for Critical Function7.5 High
- dulldusk phpfmdulldusk phpfm - Missing Authentication by Default Allows Full Filesystem Access9.8 Critical
- frangoteam fuxafrangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler7.5 High
- nasa fprime-gdsNASA fprime-gds - Missing Authentication and Path Traversal Enable Unauthenticated RCE and Spacecraft Command Injection9.8 Critical
- apache rangerApache Ranger: Download APIs expose plugin data without authentication7.5 High
- openyakOpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution9.6 Critical
- hkuds lightragLightRAG: Missing Authentication for Critical API Functions in Default Configuration9.8 Critical
- atn-b1 cpdlcNo Authentication for Very High Frequency Data Link messages used in CPDLC7.1 High
- microsoft planetary computer, planetary computer pro (geocatalog) +1 moreMicrosoft Planetary Computer Pro Elevation of Privilege Vulnerability10.0 Critical
- datalinkdc dinkyDinky Unauthenticated System Configuration and Credential Disclosure via GET /api/sysConfig/getAll8.7 High
- efstratios goudelis ground stationGround Station prior to 0.6.0 Unauthenticated Database Wipe and Arbitrary Data Injection via Socket.IO database_backup full_restore Action8.8 High
- efstratios goudelis ground stationGround Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL9.2 Critical
- efstratios goudelis ground stationGround Station prior to 0.6.0 Unauthenticated DoS via service_control Socket.IO8.7 High
- bohdan triapitsyn openchamberOpenChamber 1.11.7 Unauthenticated DoS via /api/system/shutdown8.7 High
- letta-ai lettabotletta-ai LettaBot API Status Route server.ts missing authentication6.9 Medium
- nuxt devtoolsNuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution9.6 Critical
- milvus-io milvusMilvus 2.6.22, 3.0.0 Unauthenticated Denial of Service via /management/stop8.7 High
- ibm langflow oss, langflow +1 moreLangflow is affected by security vulnerabilities in Model Context Protocol features7.5 High
- apache answerApache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow7.5 High
- nasa-ammos anmsNASA-AMMOS ANMS / JHUAPL dtnma-tools Unauthenticated Remote Command Execution via Exposed AMP Manager REST API9.8 Critical
- iotsharpIoTSharp BlobStorageController Missing Authentication and Path Traversal9.8 Critical
- eclipse theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes...7.5 High
- eclipse theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST...8.8 High
- lyric777 book-management-systemBook-Management-System - Unauthenticated Disclosure of Student PII and Borrowing History7.5 High
- suse neuvectorPotential information leakage from manager /network/graph API in NeuVector7.3 High
- nasa-ammos plandev (sequencing-server)NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server9.8 Critical
- dgtlmoon changedetection.iochangedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema5.3 Medium
- h3c nx15H3C NX15 networkSetup missing authentication6.9 Medium
- maxsite cmsMaxSite CMS 109.5 Unauthenticated AJAX Dispatcher Bypass via ajax.php9.3 Critical
- maximeamini atals-livreAtlas-Livre Unauthenticated Access via Admin Controllers Missing Exit9.3 Critical
- hewlett packard enterprise (hpe) edgeconnect sd-wan orchestratorAuthentication bypass via spoofed HTTP headers Orchestrator REST API9.8 Critical
- veeam service provider consoleA vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access...8.2 High
- qualcomm ar8035 firmware, csra6620 firmware, csra6640 firmware +141 more +143 moreMissing Authentication for Critical Function in Data Modem8.1 High
- bos ip cameraPuwell IP Camera 2.x - 4.x Unauthenticated Access via TCP Port 234569.3 Critical
- dell display and peripheral manager (ddpm mac), display and peripheral manager +1 moreDell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missing...7.8 High
- open-emr openemrOpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access8.6 High
- krayin laravel-crmKrayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup9.3 Critical
- admidioAdmidio before 5.0.11 Authentication Bypass via forum.php8.7 High
- arcadedata arcadedbArcadeDB before 26.7.3 Authentication Bypass via MCP Transport7.7 High
- dynatrace-oss dynatrace-mcpDynatrace MCP Server: Unauthenticated HTTP MCP Tool Invocation in `@dynatrace-oss/dynatrace-mcp-server`7.5 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Missing authentication decorator on Constraints, preferences, Debugger and Schema Diff routes allows unauthenticated access in SERVER mode (incomplete fix for CVE-2026-12046)6.9 Medium
- andritz 250 scala, hipase-250 +1 moreMissing authentication for logging-configuration endpoint5.3 Medium
- andritz 250 scala, hipase-250 +1 moreMissing authentication and permissive CORS policy7.5 High
- Show moreLoading…