CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- gbif integrated publishing toolkitAuthentication bypass in Integrated Publishing Toolkit9.2 Critical
- arcadedata arcadedbArcadeDB Redis Wire-Protocol Plugin Missing Authentication9.3 Critical
- arcadedata arcadedbArcadeDB MongoDB wire protocol authentication bypass cross-database9.3 Critical
- No product listedAn issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the inetd service6.5 Medium
- decolua 9router9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint8.6 High
- jeecgboot jimureportJimuReport Unauthenticated Report Listing and Share Token Disclosure8.7 High
- jetbrains pycharmIn JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP...8.4 High
- openshift-metal3 fakefishKubeVirt backend is not authenticated9.3 Critical
- lb-link wr1210mLB-Link WR1210M Backup Endpoint backup.cgi main missing authentication5.3 Medium
- No product listedTenda W20E V16.01.0.6(2782) /goform/telnet endpoint allows unauthenticated remote attackers to...9.8 Critical
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: unauthenticated exported logs download in quay5.9 Medium
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: unauthenticated secscan notification endpoint in quay when psk is unset6.5 Medium
- pax technology q80PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability7.1 High
- emlogemlog allows unauthenticated reinstallation via `install.php?action=reinstall`.9.8 Critical
- netis systems co., ltd. nc63 wireless ac1200 routerNetis NC63 V3.0.0.3327 Unauthenticated Firmware Update with Missing Cryptographic Firmware Authentication8.7 High
- getgrav gravGrav before 1.0.13 Authentication Bypass via disable2fa8.7 High
- openchoreoOpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs9.6 Critical
- openchoreoOpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation9.0 Critical
- openchoreo backstage-pluginsOpenChoreo: Unauthenticated Backstage developer-portal API exposes OpenChoreo catalog data, scaffolder logs, and allows unauthenticated catalog write/delete8.2 High
- fosowl agenticseekAgenticSeek Unauthenticated RCE via /query API Endpoint9.3 Critical
- tenda ch10, ch7, ch7g +7 more +9 moreTenda CH7 RTSP/ONVIF missing authentication6.3 Medium
- ibm websphere application server - liberty, websphere application server +1 moreIBM WebSphere Application Server Liberty is affected by an authenication bypass9.4 Critical
- signify philips hue bridge proSignify Philips Hue Bridge Pro MQTT broker missing authentication6.9 Medium
- smewebify weberpmesv2WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434)9.8 Critical
- priority portal generator addon to priority erp (developed by soft solutions)Priority – CWE-306: Missing Authentication for Critical Function9.3 Critical
- seriousm4x upsnapUpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmd9.8 Critical
- kong inc. meshKong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication5.3 Medium
- microsoft ufoMicrosoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure9.4 Critical
- progress whatsup goldWhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.9.8 Critical
- codeastro pos systemFitSoft｜POS Sytstem - Missing Authentication8.8 High
- kestra-io kestraKestra: Unauthenticated management `/worker` endpoint exposes live task configuration and plaintext credentials7.5 High
- kestra-io kestraKestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth6.5 Medium
- quanovate tech inc. (operating as mira / mira care) mira android app, mira firmware +1 moreMira Hormone Monitor, Mira Android App Missing authentication for critical function8.7 High
- quanovate tech inc. (operating as mira / mira care) mira android app, mira firmware +1 moreMira Hormone Monitor, Mira Android App Missing authentication for critical function7.1 High
- davila7 claude-code-templatesClaude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)8.8 High
- microsoft azure kubernetes serviceMicrosoft Azure Kubernetes Service Elevation of Privilege Vulnerability9.4 Critical
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Elevation of Privilege Vulnerability8.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows Remote Desktop Services Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows Remote Desktop Services Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreRemote Access Management service/API (RPC server) Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +20 more +22 moreWindows License Manager Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows Remote Desktop Services Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +16 more +18 moreWindows Remote Desktop Services Elevation of Privilege Vulnerability7.8 High
- seaweedfsSeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control9.8 Critical
- siemens simatic iot2050 advanced (6es7647-0ba00-1ya2), simatic iot2050 basic (6es7647-0ba00-0ya2), simatic iot2050 m.2 (6es7647-0bb00-1ya2) +1 more +3 moreA vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All...10.0 Critical
- wwbn avideoAVideo Unauthenticated Arbitrary File Write via aVideoEncoderChunk.json.php6.9 Medium
- swing music musicSwing Music Swing Music - Missing Authentication7.5 High
- windmill labs windmillWindmill Labs Windmill - Missing Authorization5.4 Medium
- windmill labs windmillWindmill Labs Windmill - Missing Authorization6.5 Medium
- chaskiqChaskiq Chaskiq - Missing Authentication8.2 High
- Show moreLoading…