Weaknesses of type CWE-306

3,092 results

Ausência de autenticação em funcionalidades críticas

A aplicação oferece funcionalidades sensíveis ou que consomem recursos significativos (processamento pesado, armazenamento, transações) sem verificar a identidade do usuário. Qualquer pessoa, autenticada ou não, consegue acessar e executar essas operações, comprometendo confidencialidade, integridade e disponibilidade.

Example

Um serviço de geração de relatórios expõe um endpoint `/api/gerar-relatorio` que não valida token JWT ou sessão — um atacante consegue disparar dezenas de requisições simultâneas, sobrecarregando o servidor, ou acessar dados de outros clientes sem se identificar.

How to mitigate

Implemente autenticação obrigatória antes de qualquer operação sensível (valide token, sessão ou credenciais). Para APIs, use OAuth2/JWT com verificação no início da requisição; para aplicações web, enforce sessão válida. Combine com rate limiting e quotas por usuário para conter abuso de recursos.

CVE-2026-56164MEDIUMMicrosoft SharePoint Server Elevation of Privilege VulnerabilityEPSS 1.0%KEVCVE-2025-34068CRITICALSamsung WLAN AP WEA453e < 5.2.4.T1 Unauthenticated RCE via command1 and command2 ParametersEPSS 1.0%CVE-2023-39466MEDIUMTriangle MicroWorks SCADA Data Gateway get_config Missing Authentication Information Disclosure VulnerabilityEPSS 1.0%CVE-2021-26928MEDIUMBIRD through 2.0.7 does not provide functionality for password authentication of BGP peers. Because of this, products that use BIRD (which mEPSS 1.0%CVE-2022-43990HIGHPassword recovery vulnerability in SICK SIM1012 Partnumber 1098146 with firmware version <2.2.0 allows an unprivileged remote attacker to gaEPSS 1.0%CVE-2022-43989HIGHPassword recovery vulnerability in SICK SIM2x00 (ARM) Partnumber 1092673 and 1081902 with firmware version < 1.2.0 allows an unprivileged reEPSS 1.0%CVE-2025-34218CRITICALVasion Print (formerly PrinterLogic) Exposed Internal Docker InstanceEPSS 1.0%CVE-2026-27182HIGHSaturn Remote Mouse Server UDP Command Injection RCEEPSS 1.0%CVE-2020-14140HIGHWhen Xiaomi router firmware is updated in 2020, there is an unauthenticated API that can reveal WIFI password vulnerability. This vulnerabilEPSS 1.0%CVE-2022-1368CRITICALCognex 3D-A1000 Dimensioning System Missing Authentication for Critical FunctionEPSS 1.0%CVE-2020-10754MEDIUMIt was found that nmcli, a command line interface to NetworkManager did not honour 802-1x.ca-path and 802-1x.phase2-ca-path settings, when cEPSS 1.0%CVE-2026-105728HIGHDynamics Business Central Information Disclosure VulnerabilityEPSS 1.0%CVE-2023-53774MEDIUMMiniDVBLinux 5.4 Simple VideoDiskRecorder Protocol Remote Code ExecutionEPSS 1.0%CVE-2016-10364—With X-Pack installed, Kibana versions 5.0.0 and 5.0.1 were not properly authenticating requests to advanced settings and the short URL servEPSS 1.0%CVE-2026-86124CRITICALAutoAgent Unauthenticated Remote Code Execution via the Sandbox TCP Command ServerEPSS 1.0%CVE-2023-22441HIGHMissing authentication for critical function exists in Seiko Solutions SkyBridge series, which may allow a remote attacker to obtain or alteEPSS 1.0%CVE-2023-53964HIGHSOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Factory Reset VulnerabilityEPSS 1.0%CVE-2026-22552CRITICALePower epower.ie Missing Authentication for Critical FunctionEPSS 1.0%CVE-2025-5095CRITICALBurk Technology ARC Solo Missing Authentication for Critical FunctionEPSS 1.0%CVE-2026-121933CRITICALLinksys E5350 Setup Wizard apply.cgi save_settings missing authenticationEPSS 1.0%