Weaknesses of type CWE-306

3,092 results

Ausência de autenticação em funcionalidades críticas

A aplicação oferece funcionalidades sensíveis ou que consomem recursos significativos (processamento pesado, armazenamento, transações) sem verificar a identidade do usuário. Qualquer pessoa, autenticada ou não, consegue acessar e executar essas operações, comprometendo confidencialidade, integridade e disponibilidade.

Example

Um serviço de geração de relatórios expõe um endpoint `/api/gerar-relatorio` que não valida token JWT ou sessão — um atacante consegue disparar dezenas de requisições simultâneas, sobrecarregando o servidor, ou acessar dados de outros clientes sem se identificar.

How to mitigate

Implemente autenticação obrigatória antes de qualquer operação sensível (valide token, sessão ou credenciais). Para APIs, use OAuth2/JWT com verificação no início da requisição; para aplicações web, enforce sessão válida. Combine com rate limiting e quotas por usuário para conter abuso de recursos.

CVE-2019-18230—Honeywell equIP and Performance series IP cameras, multiple versions, A vulnerability exists where the affected product allows unauthenticatEPSS 1.1%CVE-2023-27747HIGHBlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authentication in its web server. This vulnerability allows attackers to access seEPSS 1.1%CVE-2025-3699CRITICALMissing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation G-50 all versions, G-50-W all versions, G-50A EPSS 1.1%CVE-2022-30230CRITICALA vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected application does not require authenticEPSS 1.1%CVE-2023-36851MEDIUMJunos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary filesEPSS 1.1%KEVCVE-2025-4268MEDIUMTOTOLINK A720R cstecgi.cgi missing authenticationEPSS 1.1%CVE-2025-34130HIGHLILIN DVR Arbitrary File Read via net_html.cgiEPSS 1.1%CVE-2024-39273CRITICALA firmware update vulnerability exists in the fw_check.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP requeEPSS 1.1%CVE-2026-86121CRITICALCua computer-server before 0.3.42 Unauthenticated RCE via Desktop ControlEPSS 1.1%CVE-2025-26345CRITICALA CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.EPSS 1.1%CVE-2025-26344CRITICALA CWE-306 "Missing Authentication for Critical Function" in maxprofile/guest-mode/routes.lua in Q-Free MaxTime less than or equal to versionEPSS 1.1%CVE-2025-26339CRITICALA CWE-306 "Missing Authentication for Critical Function" in maxtime/handleRoute.lua in Q-Free MaxTime less than or equal to version 2.11.0 aEPSS 1.1%CVE-2025-26347CRITICALA CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.EPSS 1.1%CVE-2025-26341CRITICALA CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2EPSS 1.1%CVE-2025-26342CRITICALA CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2EPSS 1.1%CVE-2021-20998CRITICALWAGO: Managed Switches: Unauthorized creation of user accountsEPSS 1.1%CVE-2022-41272CRITICALAn unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search (UDS) of SAP NeEPSS 1.1%CVE-2026-72776CRITICALAgenticSeek Unauthenticated RCE via /query API EndpointEPSS 1.1%CVE-2026-69111HIGHMilvus 2.6.22, 3.0.0 Unauthenticated Denial of Service via /management/stopEPSS 1.1%CVE-2023-23452CRITICALMissing Authentication for Critical Function in SICK FX0-GPNT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to EPSS 1.1%