CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior...5.3 Medium
- yordam informatics technology consulting, training, and electronic systems industry and trade inc. library reservation systemImproper Authorization in Yordam Informatics' Library Reservation System4.3 Medium
- auth0 ad/ldap connectorUnauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector6.7 Medium
- eclipse foundation aeriosIn the current development version of Eclipse aeriOS, for which no official release has yet been...9.9 Critical
- moltis-org moltismoltis-org moltis vault.rs vault_recovery_handler missing authentication6.9 Medium
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 23h2 +12 more +14 moreWindows Autopilot Tampering Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +20 more +22 moreWindows Internet Connection Sharing (ICS) Tampering Vulnerability5.5 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +16 more +18 moreWindows Modern Device Management (MDM) Security Feature Bypass Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows Power Dependency Coordinator Tampering Vulnerability5.5 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +16 more +18 moreWindows Cloud Files Mini Filter Driver Tampering Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreMicrosoft Windows Search Component Tampering Vulnerability5.5 Medium
- microsoft windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 +7 more +9 moreWindows Shell Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2012 +12 more +14 moreWindows DHCP Server Elevation of Privilege Vulnerability6.8 Medium
- wwbn avideoAVideo through 29.0 Unauthenticated Disclosure via epg.json.php8.7 High
- wwbn avideoAVideo through 29.0 Information Disclosure via stats.json.php8.7 High
- commvault, commvault cloud +1 morePrivate Metrics Server Denial of Service8.8 High
- siemens reyrolle 7sr5A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is...9.3 Critical
- asus control center express agentMissing authentication for a critical function in ASUS Control Center Express Agent allows an...7.7 High
- knowns-dev knownsknowns before 0.30.0 Unauthenticated Management API Exposure9.3 Critical
- knowns-dev knownsknowns before 0.30.0 Path Traversal via MCP doc and memory tools8.7 High
- jetbrains golandIn JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected...5.9 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC...8.4 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its...3.7 Low
- jetbrains hubIn JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service...9.8 Critical
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior...8.2 High
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior...7.5 High
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...8.1 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +12 more +14 moreIpa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci9.8 Critical
- sourcecodester simple traffic offense systemSourceCodester Simple Traffic Offense System Deletion Endpoint delete-user.php missing authentication6.9 Medium
- sourcecodester simple traffic offense systemSourceCodester Simple Traffic Offense System User Creation saveuser.php missing authentication6.9 Medium
- nec corporation univerge ix-r/ix-vAn authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V. A user...9.3 Critical
- thu-maic openmaicOpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation9.0 Critical
- brokercap bifrostUnauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds8.1 High
- mikrotik routerosKernel memory disclosure and denial of service in MikroTik RouterOS btest service8.8 High
- laradashboardLara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route9.3 Critical
- hkuds autoagentAutoAgent Unauthenticated Remote Code Execution via the Sandbox TCP Command Server9.3 Critical
- trycua cua-computer-serverCua computer-server before 0.3.42 Unauthenticated RCE via Desktop Control9.3 Critical
@typespec/spectornpmTypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop7.5 High- ramon-victor freegpt-webuiramon-victor freegpt-webui Backend Conversation API backend.py _conversation missing authentication6.9 Medium
- ramon-victor freegpt-webuiramon-victor freegpt-webui Authentication Check __init__.py ChatCompletion.create missing authentication6.9 Medium
- jofpin trapejofpin trape Admin Endpoint sockets.py join_room missing authentication6.9 Medium
- jofpin trapejofpin trape Login Endpoint stats.py missing authentication6.9 Medium
- nangohq nangoNango < 0.71.6 Missing Authentication RCE via runner tRPC server9.2 Critical
- ibm iIBM i is Affected By Denial of Service Vulnerabilities in NFS [, ]6.5 Medium
- lm-sys fastchatFastChat Unauthenticated Worker Registration SSRF and Model Spoofing9.3 Critical
- ten-frameworkTEN Framework 0.11.71 Unauthenticated File Read/Write via TMAN Designer9.3 Critical
- netease-youdao qanythingQAnything 2.0.0 Unauthenticated Cross-User File Disclosure8.7 High
- teamwiseflow xiaobeixiaobei through 5.5.2 Unauthenticated Webhook Message Injection9.3 Critical
- aimhubio aimAim 3.29.1 Remote Code Execution via Unauthenticated Method Dispatch9.3 Critical
- asus control center enterprise (acc)Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard...10.0 Critical
- Show moreLoading…