CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- oracle access managerVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component:...9.8 Critical
- oracle access managerVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component:...9.1 Critical
- oracle access managerVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component:...9.8 Critical
- oracle access managerVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component:...10.0 Critical
- oracle identity managerVulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core...9.8 Critical
- oracle weblogic serverVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)...9.8 Critical
- oracle weblogic serverVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)...9.8 Critical
- oracle weblogic serverVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)...9.8 Critical
- hewlett packard enterprise (hpe) edgeconnect sd-wan gateways, arubanetworks edgeconnect sd-wan orchestrator, hpe edgeconnect operating system +2 moreUnauthenticated Sensitive Information Disclosure in HPE Networking EdgeConnect SD-WAN Gateways5.9 Medium
- dell wyse management suiteDell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Authentication for...7.5 High
- gitlabMissing Authentication for Critical Function in GitLab5.4 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below 9.5.4 allows privilege escalation because adding users and assigning groups do not require additional identity verification8.5 High
- dromara lamp-cloudlamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint8.7 High
- stamparm maltrailstamparm maltrail Blacklist Endpoint httpd.py _blacklist missing authentication6.9 Medium
- marcoscamara01 ecommerce templateMissing authentication in Ecommerce Template checkout session endpoint allows unauthenticated disclosure of buyer PII8.2 High
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to authentication bypass and insufficient session expiration4.2 Medium
- esphome device-builderESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade9.8 Critical
- krayin laravel-crmKrayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse8.8 High
- langbot-app langbotLangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket8.8 High
- brokercap bifrostBifrost unauthenticated remote code execution via MCP stdio client registration9.8 Critical
- contec co., ltd. cpsl-08p1enMissing authentication for critical function vulnerability exists in CPSL-08P1EN. If this...8.7 High
- contec co., ltd. remote i/o coupler unit (server type) cpsn-mcb271-*Missing authentication for critical function vulnerability exists in Remote I/O Coupler Unit ...6.9 Medium
- 0x4m4 hexstrike ai0x4m4 HexStrike AI API Command Endpoint hexstrike_server.py missing authentication6.9 Medium
- cheshire-cat-ai cheshire cat aicheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key missing authentication6.9 Medium
- jaychouchannel tourism-management-systemjaychouchannel Tourism-Management-System Update Endpoint missing authentication6.9 Medium
- simalexan api-lambda-send-email-sessimalexan api-lambda-send-email-ses API Gateway Endpoint template.yml SES.sendEmail missing authentication6.9 Medium
- vvbbnn00 warp-clash-apivvbbnn00 WARP-Clash-API authorized missing authentication6.9 Medium
- wwbn avideoWWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php6.9 Medium
- cisa malcolmMissing Authentication for Critical Function in Malcolm6.9 Medium
- t-mart mouseholeMousehole: Unauthenticated HTTP/WebSocket boundary exposes and mutates MAM cookie state6.9 Medium
- designcomputer mysql mcp serverMySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)10.0 Critical
- getsimplecms, getsimplecms-ce +1 moreGetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw9.8 Critical
- moxi624 mogublogMoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpoint6.9 Medium
- moxi624 mogublogMoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints6.9 Medium
- progress software chef automatePrivilege Escalation in Progress Chef Automate10.0 Critical
- wwbn avideoWWBN AVideo Unauthenticated File Read via getRecordedFile.php8.7 High
- howyar weenygeniusHowyar｜WeenyGenius - Missing Authentication8.7 High
- diegosouzapw omnirouteOmniRoute ACP Custom-Agent Remote Code Execution (RCE)9.5 Critical
- ibm websphere application serverIBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities6.5 Medium
- rclonerclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass9.8 Critical
- geovision inc. gv-lpc2011/lpc2211GV-LPC2011/LPC2211 - Unauthenticated PTZ Control Service9.4 Critical
- apache artemis, apache software foundation activemq artemis +1 moreApache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation7.5 High
- apache artemis, apache software foundation activemq artemis +1 moreApache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription7.5 High
- apache artemis, apache software foundation activemq artemis +1 moreApache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers9.1 Critical
- apache artemis, apache software foundation activemq artemis +1 moreApache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment9.8 Critical
- apache artemis, apache software foundation activemq artemis +1 moreApache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion9.1 Critical
- deryeger yegerYeger: Unauthenticated Network-Exposed Turborepo Task Execution via /api/run8.8 High
- rabindralamsal inventory-management-systemRizwan17 inventory-management-system Invoice Generation invoice_bill.php missing authentication6.9 Medium
- rabindralamsal inventory-management-systemRizwan17 inventory-management-system AJAX Backend process.php DBOperation.addCategory missing authentication6.9 Medium
- softish c6 ear camera, earvision android application +1 moreSoftish C6 Ear Camera and EarVision Android Application Missing authentication for critical function8.5 High
- Show moreLoading…