Weaknesses of type CWE-306

3,091 results

Ausência de autenticação em funcionalidades críticas

A aplicação oferece funcionalidades sensíveis ou que consomem recursos significativos (processamento pesado, armazenamento, transações) sem verificar a identidade do usuário. Qualquer pessoa, autenticada ou não, consegue acessar e executar essas operações, comprometendo confidencialidade, integridade e disponibilidade.

Example

Um serviço de geração de relatórios expõe um endpoint `/api/gerar-relatorio` que não valida token JWT ou sessão — um atacante consegue disparar dezenas de requisições simultâneas, sobrecarregando o servidor, ou acessar dados de outros clientes sem se identificar.

How to mitigate

Implemente autenticação obrigatória antes de qualquer operação sensível (valide token, sessão ou credenciais). Para APIs, use OAuth2/JWT com verificação no início da requisição; para aplicações web, enforce sessão válida. Combine com rate limiting e quotas por usuário para conter abuso de recursos.

CVE-2026-32985CRITICALXerte Online Toolkits <= 3.14 Unauthenticated Template Import Arbitrary File Upload Leading to Remote Code ExecutionEPSS 1.5%CVE-2024-45274CRITICALMB connect line/Helmholz: Remote code execution via confnet serviceEPSS 1.5%CVE-2014-125113CRITICALDell/Quest KACE K1000 Unauthenticated File Upload RCEEPSS 1.5%CVE-2022-1300CRITICALMissing authentication in TRUMPF products may result in corruption of dataEPSS 1.5%CVE-2026-0650CRITICALOpenFlagr <= 1.1.18 Authentication Bypass via Prefix Whitelist Path NormalizationEPSS 1.5%CVE-2019-1629MEDIUMCisco Integrated Management Controller Arbitrary File Write VulnerabilityEPSS 1.5%CVE-2019-6542—ENTTEC Datagate MK2, Storm 24, Pixelator all firmware versions prior to (70044,70050,70060)_update_05032019-482 allows an unauthenticated usEPSS 1.5%CVE-2026-47212MEDIUMSymfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event InjectionEPSS 1.5%CVE-2026-47391CRITICALPraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool executionEPSS 1.5%CVE-2021-22279CRITICALOmniCore RobotWare Missing Authentication VulnerabilityEPSS 1.5%CVE-2024-5718HIGHLogsign Unified SecOps Platform Missing Authentication Remote Code Execution VulnerabilityEPSS 1.5%CVE-2026-57967CRITICALApache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachmentEPSS 1.5%CVE-2020-10265CRITICALRVD#1443: UR dashboard server enables unauthenticated remote control of core robot functionsEPSS 1.5%CVE-2026-72529CRITICALA remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X tEPSS 1.5%KEVCVE-2024-39608CRITICALA firmware update vulnerability exists in the login.cgi functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP requestEPSS 1.5%CVE-2020-12506CRITICALWAGO: Authentication Bypass Vulnerability in WAGO 750-36X and WAGO 750-8XX Versions <= FW03EPSS 1.5%CVE-2025-34221CRITICALVasion Print (formerly PrinterLogic)EPSS 1.5%CVE-2022-27582CRITICALPassword recovery vulnerability in SICK SIM4000 (PPC) Partnumber 1078787 allows an unprivileged remote attacker to gain access to the userleEPSS 1.4%CVE-2022-27585CRITICALPassword recovery vulnerability in SICK SIM1000 FX Partnumber 1097816 and 1097817 with firmware version <1.6.0 allows an unprivileged remoteEPSS 1.4%CVE-2022-27586CRITICALPassword recovery vulnerability in SICK SIM1004 Partnumber 1098148 with firmware version <2.0.0 allows an unprivileged remote attacker to gaEPSS 1.4%