CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- mcp-routermcp-router CLI before 0.6.3 Binds the MCP Aggregator to All Interfaces Without Requiring Authentication9.3 Critical
- apitableAPITable through 1.13.0-beta.1 Missing Authentication on the Internal Account Closure Endpoints8.8 High
- apitableAPITable through 1.13.0-beta.1 Missing Authentication on the Internal Notification Create Endpoint6.9 Medium
- 1panel-dev kubepiKubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF10.0 Critical
- codeastro payroll systemitsourcecode Payroll System CRUD Operation ajax.php delete missing authentication6.9 Medium
- static-web-serverStatic Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled4.3 Medium
- spring cloud config, vmware spring cloud config +1 moreSpring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests6.8 Medium
- slackhq nebulaNebulaGraph through 3.8.0 Unauthenticated Read and Modification of Runtime Configuration9.3 Critical
- cayin technology cms-se, cms-ws +1 moreCAYIN Technology｜CAYIN CMS-WS/CMS-SE - Missing Authentication6.9 Medium
nettyUbuntuThe Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no...9.8 Critical- drupal pankmPanKM - Critical - Unsupported - SA-CONTRIB-2026-0835.7 Medium
- nvidia nemoclawNVIDIA NemoClaw for Linux contains a vulnerability in its inference server setup, where a remote...8.1 High
- djust-org djustdjust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls8.2 High
- cbcoutinho nextcloud-mcp-serverNextcloud MCP Server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )9.1 Critical
- mervinpraison praisonaiPraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret8.2 High
- mervinpraison praisonaiPraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete8.6 High
- mervinpraison praisonaiPraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated7.3 High
- mervinpraison praisonaiPraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution8.6 High
- mervinpraison praisonai, praisonaiagents +1 morepraisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-862)8.2 High
- mervinpraison praisonaiPraisonAI: Origin validation bypass in MCP HTTP Stream transport allows browser-mediated unauthenticated tool execution on local MCP server6.9 Medium
- watchguard agentWatchGuard Agent improper authentication allows unauthenticated remote code execution9.3 Critical
- watchguard agentWatchGuard Agent path traversal allows unauthenticated remote code execution9.4 Critical
- furuno electric co., ltd. fa-50FA-50 all versions miss authentication for some configuration. An attacker with access to the...8.7 High
- faveo helpdeskFaveo Helpdesk post-ticket-reply Endpoint FormController.php post_ticket_reply missing authentication6.9 Medium
- rconfigrConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php9.3 Critical
- ransomlookMissing Authentication Allows Unauthorized Creation of Crypto Groups in RansomLook8.8 High
- kaon pg5298a, pg5298b +1 moreMissing Authentication for Critical Function in KAON PG52987.1 High
- dji air 3, air 3s, avata 2 +13 more +15 moreDJI Drone Bluetooth Interface Unauthenticated DUML Command Execution8.5 High
- dji air 3, air 3s, avata 2 +13 more +15 moreDJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media8.7 High
- cybertutor newsiteserver (nss)CyberTutor｜NewSiteServer (NSS) - Missing Authentication6.9 Medium
- wwbn avideoAVideo Authentication Bypass via Unkeyed Video Hash Disclosure8.7 High
- basekick-labs arcArc Enterprise cluster replication accepts unauthenticated MsgReplicateSync messages, enabling cluster-wide data injection from any TLS-trusted peer8.3 High
- combodo itopCombodo iTop: Unauthenticated user can delete .readonly file6.5 Medium
- combodo itopCombodo iTop: Authentication bypass in exec.php allows PHP file execution8.6 High
- esri portal for arcgismissing authentication vulnerability in Esri Portal for ArcGIS5.3 Medium
- combodo itopCombodo iTop: Insecured access to uploaded images via sniffed url7.5 High
- checkmk gmbh checkmkAgent receiver accepts mTLS requests without a client certificate6.9 Medium
- ikas technology inc. rushUnauthenticated API Allows Analytics Data Manipulation in IKAS Technology's Rush5.3 Medium
- yamaha corporation vocaloid6Missing authentication for critical function vulnerability exists in VOCALOID6. Any process...4.8 Medium
- datiphy inc. data management centerDatiphy Data Management Center - Missing Authentication for Critical Function8.8 High
- mailuMailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictions7.5 High
- ptc windchill risk and reliability enterprise edition (formerly relex)Critical Bypass Access Control Vulnerability Reported for Windchill Risk and Reliability (WRR) Enterprise Edition9.3 Critical
- tp-link dr3150 firmware, dr3220v-4g firmware, dr3650v-4g firmware +34 more +36 moreUnauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways6.0 Medium
- t8y2 dbxdbx: Unauthenticated arbitrary SQL execution in dbx-web (authentication fails open when no password is configured)9.8 Critical
- osnexus quantastorOSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability9.8 Critical
- baylan measuring instruments industry and trade inc. smart meter management application (bms)Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS9.8 Critical
- frauscher sensortechnik fds 102Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is offering files with sensitive information for download without requiring authentication8.7 High
- No product listedThe Library Corporation LS2 Admin v5.7 to v5.8.0 was discovered to contain an information...7.5 High
- splunk, splunk enterprise +1 moreUnauthenticated Information Disclosure through an Edge Processor Service Endpoint in Splunk Enterprise7.5 High
- icecoderICEcoder 8.1 Unauthenticated RCE via terminal-xhr.php8.7 High
- Show moreLoading…