CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- ibm guardium data protectionIBM Guardium Data Protection Missing Authentication9.8 Critical
- mjob mjobtimemJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx9.3 Critical
- iskratel innboxIskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter9.3 Critical
- broadcom brocade active support connectivity gateway, brocade active support connectivity gateway +1 moreAn authentication flaw exists in the Brocade ASCG administrative management service component. An...8.7 High
- broadcom brocade active support connectivity gateway, brocade active support connectivity gateway +1 moreA vulnerability has been identified in the data collection service of Brocade ASCG versions...8.6 High
- broadcom brocade active support connectivity gateway, brocade active support connectivity gateway +1 moreA critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The...8.7 High
- brocade fabric os, broadcom fabric operating system +1 moreA session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS...8.5 High
- brocade fabric os, broadcom fabric operating system +1 moreA critical authorization bypass vulnerability exists in the Management Server handling of Brocade...7.1 High
- splunk, splunk enterprise +1 moreMissing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise9.8 Critical
- cisco license on-premCisco License On-Prem Security Hardening Release9.8 Critical
- sipcapture homerHomer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)9.8 Critical
- lmcacheLMCache through 0.5.5 Missing Authentication in Frontend Node Catalog Allows SSRF Allowlist Bypass6.9 Medium
- lmcacheLMCache through 0.5.5 Missing Authentication in MP HTTP Server Management API8.8 High
- lmcacheLMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API8.8 High
- lmcacheLMCache through 0.5.5 Unauthenticated RCE via /run_script Endpoint9.3 Critical
- mispMISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances7.1 High
- red hat satellite 6Rubygem-smart_proxy_dynflow: task update and done callbacks accept unauthenticated requests5.9 Medium
- lmcacheLMCache Unauthenticated RCE in multiprocess mode via pickle deserialization9.8 Critical
- No product listedThe websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper...9.8 Critical
- No product listedThe websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper...9.1 Critical
- arista networks cloudvision cueSecurity Advisory 01909.3 Critical
- hewlett packard enterprise (hpe) clearpass policy manager (cppm)Authentication Bypass in the API Interface Allows Unauthorized Information Disclosure in ClearPass Policy Manager5.3 Medium
- multiversx labs s.r.l. multisig-improvedCVE-2026-1065119.8 Critical
- dell container storage modulesDell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for...5.4 Medium
- dell container storage modules (csm), container storage modules +1 moreDell Container Storage Modules (CSM), versions prior to 1.18.0, contains a Missing Authentication...7.1 High
- dell container storage modulesDell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for...10.0 Critical
- dell container storage modules, container storage modules (csm) +1 moreDell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing...10.0 Critical
- kvcache-ai mooncakeMooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCs8.8 High
- kvcache-ai mooncakeMooncake through 0.3.13.post1 Missing Authentication in Store REST Service9.3 Critical
- murrelektronik software aas edge client all versionsMissing authentication for critical function in the aas-edge-client REST API9.3 Critical
- ossrs srsOSSRS srs System API api.go systemAPI.Run missing authentication6.9 Medium
- laurent22 joplinJoplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier8.5 High
- red hat multicluster engine for kubernetesMaestro: maestro: grpc broker has no auth interceptor and client mtls is optional5.4 Medium
- red hat multicluster engine for kubernetesMaestro: maestro: rest api write endpoints registered without authentication middleware6.5 Medium
- casdoorCasdoor API Endpoint authz_filter.go ApiFilter missing authentication6.9 Medium
- kishor-23 food-waste-management-systemkishor-23 food-waste-management-system Admin Signup signup.php missing authentication6.9 Medium
- zitadelZITADEL before 4.17.3 Account Takeover via External IdP Linking9.3 Critical
- openidentityplatform openamOpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface8.8 High
- nasa-ammos ait-coreUnauthenticated ZeroMQ command/telemetry bus in AIT-Core allows remote spacecraft command injection and telemetry exfiltration9.8 Critical
- hkuds vibe-tradingHKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE9.3 Critical
- triggerdotdev trigger.devTrigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint6.9 Medium
- zilliz attuZilliz Attu before 3.0.0 has a Playground feature that does not require authentication for...5.8 Medium
- monta monta.appMonta monta.app Missing Authentication for Critical Function9.3 Critical
- utmstackUTMStack < 11.2.16 Authentication Bypass via InternalApiKeyFilter9.3 Critical
- aws loomMissing authentication for critical function in Loom for AWS10.0 Critical
- yeswikiYesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler6.9 Medium
- kvcache-ai mooncakeMooncake through 0.3.13.post1 Missing Authentication in HTTP Metadata Server8.8 High
- filamentphp filamentFilament: Multi-factor authentication (app) management actions do not require password reauthentication5.4 Medium
- teledyne flir aware2Missing Authentication in Teledyne FLIR Robots running Aware27.1 High
- akhilrex podgrabPodgrab Missing Authentication on WebSocket /ws Endpoint6.3 Medium
- Show moreLoading…