CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedNo authentication exists in the MQTT service of Trueview 6.0.23.4. The MQTT broker accepts client...9.8 Critical
- No product listedPowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer...9.8 Critical
- microsoft azure ai language authoringAzure AI Language Elevation of Privilege Vulnerability10.0 Critical
- themoos core-moosMOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable Write9.3 Critical
- themoos core-moosMOOS core-moos through 10.4.0 Missing Authentication for MOOSDB Publish, Subscribe and DB_CLEAR9.3 Critical
- seppmail ag secure email gateway (seg)Mandatory MFA bypass before enrollment7.7 High
- microsoft winml-cliWindows ML CLI: CORS misconfig enables localhost RCE8.6 High
- tsi-coop tsi-dpdp-cmstsi-coop tsi-dpdp-cms Bootstrap Setup Endpoint InterceptingFilter.java missing authentication6.9 Medium
- tsi-coop tsi-dpdp-cmstsi-coop tsi-dpdp-cms Admin Console/DPO Compliance Console web.xml missing authentication6.9 Medium
- 8 degree themes notification bar for wordpressNotification Bar for WordPress <= 1.1.8 – Unauthenticated Subscriber Data Disclosure5.3 Medium
- apitableAPITable through 1.13.0-beta.1 Missing Authentication on the Internal Organization Load or Search Endpoint8.7 High
- openatomfoundation pikiwidbPika Unauthenticated Replication Access via Internal Protobuf Port8.8 High
- phison electronics corporation ps3111-s11 controller firmwarePhison PS3111-S11 Controller Firmware Missing Authentication on Vendor Unique Commands9.3 Critical
- oxford nano technologies minknowOxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication.8.6 High
- casdoorCasdoor upload-resource API resource.go missing authentication6.9 Medium
- arubanetworks fabric composerAuthentication Bypass in HPE Networking Fabric Composer allows Unauthorized Administrative Access6.8 Medium
- arubanetworks fabric composerUnauthenticated Denial of Service Vulnerabilities in API Endpoint of HPE Networking Fabric Composer8.2 High
- arubanetworks fabric composerAuthentication Bypass in the API of HPE Networking Fabric Composer allows Data Exposure and Unauthorized Changes8.6 High
- dell powerstore 1000t, powerstore 1200t, powerstore 3000t +10 more +12 moreDell PowerStore SDNAS contains a Missing Authentication for Critical Function vulnerability. An...9.0 Critical
- tmt machine industry and trade ltd. co. talassoft industrial management softwareMissing Authentication for Critical Function in TMT Machine's Talassoft Industrial Management Software7.5 High
- rockwell automation controlflash ®ControlFLASH ® – Improper Access Control7.0 High
- cu siliconcu silicon edit Endpoint views.py create_app missing authentication6.9 Medium
- ellite wallosMissing Authentication for Critical Function in wallos7.5 High
- sdcb chatssdcb chats Signed File Download Endpoint FileController.cs DownloadPublic missing authentication6.3 Medium
- fahad mahmood keep backup dailyKeep Backup Daily WordPress Plugin < 2.1.4 Sensitive Information Exposure via kbd_cron_process8.7 High
- profilepress membership team profilepressProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE9.2 Critical
- tenda ac18Tenda AC18 Telnet telnet missing authentication10.0 Critical
- tenda ac1206Tenda AC1206 Web UI ate R7WebsSecurityHandler missing authentication10.0 Critical
- tenda ac1206Tenda AC1206 Web UI telnet TendaTelnet missing authentication10.0 Critical
- dell powerstore 1000t, powerstore 1200t, powerstore 3000t +10 more +12 moreDell PowerStore contains a Missing Authentication for Critical Function vulnerability. An...9.8 Critical
- keployKeploy 3.1.0-3.6.25 Unauthenticated TLS Key Exposure8.8 High
- kubeedgeKubeEdge CloudCore through 1.23.1 Missing Authentication on Node Task Endpoints8.8 High
- documensoDocumenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf8.7 High
- iot-ecology rust-iot-platformrust-iot-platform Authentication Bypass via Missing Request Guards9.3 Critical
- basekick-labs arcArc: Unauthenticated cluster node admission when `cluster.shared_secret` is unset6.9 Medium
- runatlantis atlantisAtlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers8.8 High
- argoproj argo-rolloutsArgo Rollouts Dashboard Unauthenticated Mutating Operations9.3 Critical
- starrocksStarRocks Frontend REST Handlers Bypass the Base Class Authentication Gate5.3 Medium
- redpanda-data redpandaRedpanda Admin API Unauthenticated Superuser Access via Default Configuration9.3 Critical
- open zipkin zipkinZipkin Unauthenticated Spring Boot Actuator Endpoints Exposure6.9 Medium
- papercut mf/ng, mf, ng +1 more +3 morePaperCut MF/NG: Authentication Bypass8.8 High
- ebyte na111-m firmwareEbyte NA111-M Missing Authentication for Critical Function7.2 High
- xiiaozet lk100wXiiaozet LK100W Missing Authentication for Critical Function9.3 Critical
- ebyte na111-m firmwareEbyte NA111-M Missing Authentication for Critical Function9.3 Critical
- labring fastgptFastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization9.3 Critical
- unitree robotics g1 eduUnitree G1 EDU 1.5.2 BLE GATT RCE via WiFi Provisioning Stack7.7 High
- unitree robotics g1 eduUnitree G1 EDU 1.5.2 Unauthenticated RCE via DDS Bridge and Path Traversal8.7 High
- bytedance ui-tars-desktopUI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Execution10.0 Critical
- openfaas faasOpenFaaS Gateway 0.27.11 through 0.27.13 Missing Authentication on the /system/telemetry Route6.9 Medium
- team-telnyx telnyx-mcpTelnyx MCP Server through 6.83.0 Missing Authentication on Streamable HTTP Transport9.3 Critical
- Show moreLoading…