Weaknesses of type CWE-306

3,091 results

Ausência de autenticação em funcionalidades críticas

A aplicação oferece funcionalidades sensíveis ou que consomem recursos significativos (processamento pesado, armazenamento, transações) sem verificar a identidade do usuário. Qualquer pessoa, autenticada ou não, consegue acessar e executar essas operações, comprometendo confidencialidade, integridade e disponibilidade.

Example

Um serviço de geração de relatórios expõe um endpoint `/api/gerar-relatorio` que não valida token JWT ou sessão — um atacante consegue disparar dezenas de requisições simultâneas, sobrecarregando o servidor, ou acessar dados de outros clientes sem se identificar.

How to mitigate

Implemente autenticação obrigatória antes de qualquer operação sensível (valide token, sessão ou credenciais). Para APIs, use OAuth2/JWT com verificação no início da requisição; para aplicações web, enforce sessão válida. Combine com rate limiting e quotas por usuário para conter abuso de recursos.

CVE-2025-34079HIGHNSClient++ Authenticated Remote Code Execution via ExternalScripts APIEPSS 1.7%CVE-2025-21355HIGHMicrosoft Bing Remote Code Execution VulnerabilityEPSS 1.7%CVE-2024-38143MEDIUMWindows WLAN AutoConfig Service Elevation of Privilege VulnerabilityEPSS 1.7%CVE-2021-31337—The Telnet service of the SIMATIC HMI Comfort Panels system component in affected products does not require authentication, which may allow EPSS 1.7%CVE-2026-16740CRITICALMissing Authentication for Critical Function in TR7 Cyber ​​Defense's TR7 ASPEPSS 1.7%CVE-2022-25250HIGHPTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical FunctionEPSS 1.7%CVE-2020-25228—A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). A service available on port 10005/tcp of thEPSS 1.6%CVE-2022-40202CRITICAL The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper authentication. An attEPSS 1.6%CVE-2020-10625—WebAccess/NMS (versions prior to 3.0.2) allows an unauthenticated remote user to create a new admin account.EPSS 1.6%CVE-2021-3825CRITICALMissing Authorization Checks in LiderAhenkEPSS 1.6%CVE-2023-44413MEDIUMD-Link D-View shutdown_coreserver Missing Authentication Denial-of-Service VulnerabilityEPSS 1.6%CVE-2026-45695CRITICALKopia: Unauthenticated RCE via SSH ProxyCommand Injection when --insecure --without-password is usedEPSS 1.6%CVE-2026-84452HIGHWindows ML CLI: CORS misconfig enables localhost RCEEPSS 1.6%CVE-2022-20857CRITICALCisco Nexus Dashboard Unauthorized Access VulnerabilitiesEPSS 1.6%CVE-2020-3402MEDIUMCisco Unified Customer Voice Portal Information Disclosure VulnerabilityEPSS 1.6%CVE-2026-67277HIGHKernel memory disclosure and denial of service in MikroTik RouterOS btest serviceEPSS 1.6%KEVCVE-2017-2638MEDIUMIt was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnEPSS 1.6%CVE-2020-3392HIGHCisco IoT Field Network Director Missing API Authentication VulnerabilityEPSS 1.5%CVE-2022-21952HIGHSUMA unauthenticated remote DoS via resource exhaustionEPSS 1.5%CVE-2021-22772—A CWE-306: Missing Authentication for Critical Function vulnerability exists in Easergy T200 ((Modbus) SC2-04MOD-07000100 and earlier), EaseEPSS 1.5%