CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- presentonPresenton API missing authentication6.9 Medium
- roostorg coopCoop has a data leak via unauthenticated GraphQL Query.allOrgs8.7 High
- roostorg coopCoop: Unauthenticated org provisioning via GraphQL Mutation.createOrg6.9 Medium
- fctr-id okta-ai-agentTAKO AI Agent for Okta: Unauthenticated first-run administrator takeover9.8 Critical
- gojue molingMoLing: unauthenticated SSE and wildcard CORS expose tool sessions9.6 Critical
- franklioxygen mytubeMyTube: Unauthenticated Media Access via Static Routes Bypassing Login8.7 High
- towfiqi serpbearSerpBear before 3.1.1 Missing Authentication via POST /api/notify6.9 Medium
- socfortress copilotSOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount9.3 Critical
- socfortress copilotSOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Invocation and Alert Injection9.4 Critical
- dell openmanage enterpriseDell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for...5.4 Medium
- delta electronics ufc500Missing authentication check on POST/PUT requests8.7 High
- cap, teltonika networks atrm, dap +11 more +13 moreAPI permission bypass via logic bug9.4 Critical
- delinea privilege managerDelinea Privilege Manager agent unauthenticated remote code execution vulnerability8.7 High
- sylphxai pdf-reader-mcpPDF Reader MCP: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY7.5 High
- kaspersky network agent, administration server +1 moreKaspersky has fixed a vulnerability in the Network Agent for Windows module of Kaspersky Security...6.2 Medium
- canva orttoThe Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests,...8.6 High
- No product listedThe WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw...9.8 Critical
- wwbn avideo-encoderAVideo-Encoder: missing authentication on control and status endpoints7.3 High
- signalk signalk-serverSignal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs9.3 Critical
- drhelius gearboyGearboy advisory / Gearsystem body: Unauthenticated network exposure of MCP HTTP tools8.6 High
- fearlessgeekmedia fearlesscmsFearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS9.4 Critical
- juniper networks session smart routerSession Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed9.8 Critical
- No product listedWhen pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer...6.9 Medium
- tactis novigest desktop appMissing Authentication for Critical Function in Tactis' NoviGest Desktop App9.4 Critical
- tp-link systems inc. re305 v3Unauthenticated Wireless Regulatory Region Configuration in TP-Link RE3055.3 Medium
- watchguard fireware osFireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation8.7 High
- watchguard fireware osFireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection9.2 Critical
- watchguard fireware osFireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of Service6.0 Medium
- maz1987in 3dviewer-nextcloud3Dviewer-Nextcloud: Share password not enforced when streaming 3D models from a public link share7.5 High
- nvidia nemo agent toolkitNVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing...10.0 Critical
- hitachi energy tro600 series firmwareTRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit...8.7 High
- hitachi hirdb server version 10, hirdb server version 9, hirdb server version 9(32) +2 more +4 moreMissing Authentication for Critical Function Vulnerability in HiRDB9.8 Critical
- smci x12spiSupermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability9.8 Critical
- sourcecodester online food ordering systemSourceCodester Online Food Ordering System delete_admin.php missing authentication6.9 Medium
- openpanel-dev openpanelOpenPanel before 3.0.0 Missing Authentication on Worker Bull Board6.9 Medium
- apple ipados, ios and ipados, iphone os +2 moreAn authentication issue was addressed with improved state management. This issue is fixed in iOS...4.4 Medium
- cheaper-inference omnirouteOmniRoute 3.8.50 before 3.8.52 Missing Authentication via /api/sync/tokens8.2 High
- padok-team burritoBurrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset9.9 Critical
- boneioMissing Authentication for Critical Function in boneIO5.3 Medium
- boneioMissing Authentication in Default Configuration in boneIO8.7 High
- boneioMissing Authentication for Node-RED in boneIO8.7 High
- huangxd- danmu apidanmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints9.3 Critical
- No product listedBillaBear Installation InstallController.php processInstall missing authentication6.9 Medium
- 777genius agent-teams-ai777genius agent-teams-ai Local HTTP Service HttpServer.ts doStart missing authentication4.8 Medium
- giantappman livewallpaperGiantappMan LiveWallPaper SignalR Hub UploadFile missing authentication6.9 Medium
- dqzboy docker-proxyDocker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/config6.9 Medium
- zephyrproject zephyrWireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr8.2 High
- intranda goobi-viewer-coreGoobi viewer: WebSocket endpoints lack server-side authentication and origin validation6.5 Medium
- intranda goobi-viewer-coreUnauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer9.8 Critical
- netboxlabs netbox-mcp-serverNetBox MCP Server: HTTP transport exposes all NetBox data without authentication5.9 Medium
- Show moreLoading…