Weaknesses of type CWE-306

3,092 results

Ausência de autenticação em funcionalidades críticas

A aplicação oferece funcionalidades sensíveis ou que consomem recursos significativos (processamento pesado, armazenamento, transações) sem verificar a identidade do usuário. Qualquer pessoa, autenticada ou não, consegue acessar e executar essas operações, comprometendo confidencialidade, integridade e disponibilidade.

Example

Um serviço de geração de relatórios expõe um endpoint `/api/gerar-relatorio` que não valida token JWT ou sessão — um atacante consegue disparar dezenas de requisições simultâneas, sobrecarregando o servidor, ou acessar dados de outros clientes sem se identificar.

How to mitigate

Implemente autenticação obrigatória antes de qualquer operação sensível (valide token, sessão ou credenciais). Para APIs, use OAuth2/JWT com verificação no início da requisição; para aplicações web, enforce sessão válida. Combine com rate limiting e quotas por usuário para conter abuso de recursos.

CVE-2023-23452CRITICALMissing Authentication for Critical Function in SICK FX0-GPNT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to EPSS 1.1%CVE-2022-29881MEDIUMA vulnerability has been identified in SICAM T (All versions < V3.0). The web based management interface of affected devices does not employEPSS 1.1%CVE-2016-6541—TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributesEPSS 1.1%CVE-2020-15799—A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT sEPSS 1.1%CVE-2025-11942MEDIUM70mai X200 Pairing missing authenticationEPSS 1.1%CVE-2026-53913CRITICALApache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration the token is never verified and any non-null bearer value is acceptedEPSS 1.1%CVE-2023-51987CRITICALD-Link DIR-822+ V1.0.2 contains a login bypass in the HNAP1 interface, which allows attackers to log in to administrator accounts with emptyEPSS 1.1%CVE-2026-54130CRITICALM365 Copilot Information Disclosure VulnerabilityEPSS 1.1%CVE-2026-49819CRITICALUpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmdEPSS 1.1%CVE-2016-6549—Zizai Tech Nut allows for unauthenticated Bluetooth pairingEPSS 1.1%CVE-2016-15046HIGHHanwha Techwin SSM 1.32 & 1.4 ActiveMQ File Upload RCEEPSS 1.1%CVE-2022-45140CRITICALWAGO: Missing Authentication for Critical Function EPSS 1.1%CVE-2026-86184CRITICALLara Dashboard before 1.3.0 Missing Authentication in screenshot-login RouteEPSS 1.1%CVE-2026-25938CRITICALFUXA Unauthenticated Remote Code Execution in Node-RED IntegrationEPSS 1.1%CVE-2025-41703HIGHPhoenix Contact: UPS Shutdown via Unauthenticated Modbus CommandEPSS 1.1%CVE-2026-26333CRITICALCalero VeraSMART < 2022 R1 .NET Remoting Arbitrary File Read Leading to ViewState RCEEPSS 1.1%CVE-2022-44784HIGHAn issue was discovered in Appalti & Contratti 9.12.2. The target web applications LFS and DL229 expose a set of services provided by the AxEPSS 1.1%CVE-2020-36892CRITICALEibiz i-Media Server Digital Signage 3.8.0 Unauthenticated Privilege EscalationEPSS 1.1%CVE-2026-21992CRITICALVulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices) and Oracle Web Services ManagEPSS 1.0%CVE-2021-3589—An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can acEPSS 1.0%