CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- thecosy icecmsIceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints9.3 Critical
- safing portmasterSafing Portmaster before 2.2.5 Unauthenticated Forced Downgrade via /api/v1/updates/from-url4.8 Medium
- wayn111 waynboot-mallwaynboot-mall through 2.0.0 Missing Authentication via /callback/email Mail Endpoint6.9 Medium
- wayn111 waynboot-mallwaynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid6.9 Medium
- wayn111 waynboot-mallWaynboot-mall through 2.0.0 Unauthenticated Order Forgery via /callback/order/submit6.9 Medium
- 53ai 53aihub53AIHub through 0.5.3 Missing Authentication via PUT /api/enterprises/:id6.9 Medium
- hoshinosuzumi chronoframeChronoFrame through 1.0.0 Missing Authentication via Setup Wizard API8.8 High
- l429609201 misaka danmu serverMisaka Danmu Server through 2.8.9 Missing Authentication on /api/ui Routes6.9 Medium
- l429609201 misaka danmu serverMisaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollback9.3 Critical
- fastapiadminFastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints9.3 Critical
- blair2004 nexoposNexoPOS through 6.2.4 Unauthenticated Transaction Disclosure via /api/fields Endpoint6.9 Medium
- webreaper damselflyWebreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers9.3 Critical
- umbraco umbraco-cmsUmbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs6.3 Medium
- mgdaaslab wharttestWHartTest through 2.8.1 Missing Authentication on UI-Automation WebSocket Endpoints6.9 Medium
- alldatacenter alldataAllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/test8.7 High
- finsys dockhandDockhand: Unauthenticated container exec via WebSocket upgrade9.6 Critical
- j4care dcm4chee-arc-lightJ4Care dcm4che Missing Authentication for Critical Function8.7 High
- j4care dcm4chee-arc-lightJ4Care dcm4che Missing Authentication for Critical Function9.3 Critical
- apache software foundation kylinApache Kylin: Missing authentication on certain cache API endpoints9.8 Critical
- coleam00 archonArchon 0.2.13 through 0.11.1 Missing Authentication via /api/* Control API9.3 Critical
- openhealthforall openhealthOpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] Route9.2 Critical
- ivanti connect secureIvanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache...7.0 High
- energizelab fastapi ai inference serverEnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching9.8 Critical
- energizelab nestjs auth serviceEnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers8.2 High
- nutanix acropolis operating system (aos)Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS9.3 Critical
- qnap systems inc. hybriddesk stationUnauthenticated Remote Input Injection in QNAP HD Station's remotepad8.9 High
- qnap systems inc. smedio dtcp movePre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer9.3 Critical
- hewlett packard enterprise hpe nonstop tcp/ip utilitiesHPE NonStop TCP/IP UTILITIES - Denial of Service vulnerability7.5 High
- hewlett packard enterprise hpe nonstop tcp/ip utilitiesHPE NonStop TCP/IP UTILITIES - Denial of Service vulnerability5.3 Medium
- freerdpFreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm Active bypass8.7 High
- error311 fileriseFileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php5.3 Medium
- error311 fileriseFileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activates before verification6.5 Medium
- error311 fileriseFileRise: Missing Authentication Guard on File Snippet Preview Endpoint3.7 Low
- error311 fileriseFileRise: Setup mode re-activates when users.txt becomes empty, allowing unauthenticated admin creation7.4 High
- openaev-platform openaevOpenAEV has unauthenticated access and missing object-level authorization on player lessons API8.2 High
- cemtan sar2htmlcemtan sar2html sar2html.py deleteAll missing authentication6.9 Medium
- dgraph-io dgraphDgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service9.2 Critical
- dbt-labs dbt-coredbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`8.2 High
- lantronix xpress-dr, xpress-dr-i +1 moreLantronix XPress-DR 8.1.0.0 Unauthenticated Configuration Write via UDP 307189.3 Critical
- report one myreport updaterReport One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE9.2 Critical
- fatedier frpfrp 0.41.0 through 0.71.1 Missing Authentication for pprof Debug Endpoints6.3 Medium
- pppscn smsforwarderSmsForwarder through 3.5.0 Missing Authentication in HTTP Server Remote Control API8.6 High
- nullclaw nullhubNullHub through 2026.5.29 Missing Authentication for /api Management API9.2 Critical
- tr7 cyber defense inc. aspMissing Authentication for Critical Function in TR7 Cyber Defense's TR7 ASP9.8 Critical
- jtl-software gmbh jtl-shopUnauthenticated Plugin Safe Mode Toggle Vulnerability in JTL-Shop8.7 High
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +3 more +5 moreClevis: clevis: no authentication on pkcs#11 af_unix sockets allows key injection under permissive umask4.7 Medium
- tp-link systems inc. ep10 v1, ep40 v1, ep40a v1 +21 more +23 moreImproper Authentication and Credential Exposure in Multiple TP-Link Kasa Devices8.7 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +18 more +20 moreWindows Setup and Deployment Elevation of Privilege Vulnerability7.0 High
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 23h2 +14 more +16 moreWindows Security Account Manager Tampering Vulnerability5.5 Medium
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +5 more +7 moreWindows Health and Optimized Experiences Service Elevation of Privilege Vulnerability7.8 High
- Show moreLoading…