Weaknesses of type CWE-306

2,592 results

Ausência de autenticação em funcionalidades críticas

A aplicação oferece funcionalidades sensíveis ou que consomem recursos significativos (processamento pesado, armazenamento, transações) sem verificar a identidade do usuário. Qualquer pessoa, autenticada ou não, consegue acessar e executar essas operações, comprometendo confidencialidade, integridade e disponibilidade.

Example

Um serviço de geração de relatórios expõe um endpoint `/api/gerar-relatorio` que não valida token JWT ou sessão — um atacante consegue disparar dezenas de requisições simultâneas, sobrecarregando o servidor, ou acessar dados de outros clientes sem se identificar.

How to mitigate

Implemente autenticação obrigatória antes de qualquer operação sensível (valide token, sessão ou credenciais). Para APIs, use OAuth2/JWT com verificação no início da requisição; para aplicações web, enforce sessão válida. Combine com rate limiting e quotas por usuário para conter abuso de recursos.

CVE-2022-45479CRITICALPC Keyboard allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorizatEPSS 1.7%CVE-2020-14501—Advantech iView, versions 5.6 and prior, has an improper authentication for critical function (CWE-306) issue. Successful exploitation of thEPSS 1.7%CVE-2025-21355HIGHMicrosoft Bing Remote Code Execution VulnerabilityEPSS 1.7%CVE-2024-38143MEDIUMWindows WLAN AutoConfig Service Elevation of Privilege VulnerabilityEPSS 1.7%CVE-2021-31337—The Telnet service of the SIMATIC HMI Comfort Panels system component in affected products does not require authentication, which may allow EPSS 1.7%CVE-2025-34116HIGHIPFire < 2.19 Core Update 101 proxy.cgi RCEEPSS 1.7%CVE-2022-25250HIGHPTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical FunctionEPSS 1.7%CVE-2020-25228—A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). A service available on port 10005/tcp of thEPSS 1.6%CVE-2020-10625—WebAccess/NMS (versions prior to 3.0.2) allows an unauthenticated remote user to create a new admin account.EPSS 1.6%CVE-2021-3825CRITICALMissing Authorization Checks in LiderAhenkEPSS 1.6%CVE-2025-34104CRITICALPiwik Authenticated RCE via Custom Plugin UploadEPSS 1.6%CVE-2026-45695CRITICALKopia: Unauthenticated RCE via SSH ProxyCommand Injection when --insecure --without-password is usedEPSS 1.6%CVE-2011-10013CRITICALTraq 2.0–2.3 admincp/common.php RCEEPSS 1.6%CVE-2025-34079HIGHNSClient++ Authenticated Remote Code Execution via ExternalScripts APIEPSS 1.6%CVE-2020-3402MEDIUMCisco Unified Customer Voice Portal Information Disclosure VulnerabilityEPSS 1.6%CVE-2017-2638MEDIUMIt was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnEPSS 1.6%CVE-2022-20857CRITICALCisco Nexus Dashboard Unauthorized Access VulnerabilitiesEPSS 1.6%CVE-2026-72529CRITICALA remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X tEPSS 1.6%KEVCVE-2012-10030CRITICALFreeFloat FTP Server Arbitrary File UploadEPSS 1.5%CVE-2020-3392HIGHCisco IoT Field Network Director Missing API Authentication VulnerabilityEPSS 1.5%