Weaknesses of type CWE-306

3,093 results

Ausência de autenticação em funcionalidades críticas

A aplicação oferece funcionalidades sensíveis ou que consomem recursos significativos (processamento pesado, armazenamento, transações) sem verificar a identidade do usuário. Qualquer pessoa, autenticada ou não, consegue acessar e executar essas operações, comprometendo confidencialidade, integridade e disponibilidade.

Example

Um serviço de geração de relatórios expõe um endpoint `/api/gerar-relatorio` que não valida token JWT ou sessão — um atacante consegue disparar dezenas de requisições simultâneas, sobrecarregando o servidor, ou acessar dados de outros clientes sem se identificar.

How to mitigate

Implemente autenticação obrigatória antes de qualquer operação sensível (valide token, sessão ou credenciais). Para APIs, use OAuth2/JWT com verificação no início da requisição; para aplicações web, enforce sessão válida. Combine com rate limiting e quotas por usuário para conter abuso de recursos.

CVE-2026-121933CRITICALLinksys E5350 Setup Wizard apply.cgi save_settings missing authenticationEPSS 1.0%CVE-2022-44013CRITICALAn issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can make various API calls without authentication because the EPSS 1.0%CVE-2026-68502CRITICALLazyOwn: Unauthenticated Socket.IO `input` Event Reaches LazyOwn Command Dispatcher — Unauthenticated RCEEPSS 1.0%CVE-2026-0625CRITICALD-Link DSL/DIR/DNS Authentication Bypass via DNS Configuration EndpointEPSS 1.0%CVE-2026-57131CRITICALpraisonai: Jobs API exposes agent-execution endpoints with no authenticationEPSS 1.0%CVE-2025-34224CRITICALVasion Print (formerly PrinterLogic) Unauthenticated Device ModificationEPSS 1.0%CVE-2026-53977HIGHOpenChamber 1.11.7 Unauthenticated DoS via /api/system/shutdownEPSS 1.0%CVE-2026-1579CRITICALPX4 Autopilot Missing authentication for critical functionEPSS 1.0%CVE-2023-25589CRITICALUnauthenticated Arbitrary User Creation Leads to Complete System CompromiseEPSS 1.0%CVE-2026-50027CRITICALmcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/DeleteEPSS 1.0%CVE-2023-21837HIGHVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected areEPSS 1.0%CVE-2023-1096CRITICALSnapCenter versions 4.7 prior to 4.7P2 and 4.8 prior to 4.8P1 are susceptible to a vulnerability which could allow a remote unauthenticated EPSS 1.0%CVE-2026-57206HIGHSimpleChat plugin validation endpoints missing authentication and authorizationEPSS 1.0%CVE-2026-110616CRITICALNullHub through 2026.5.29 Missing Authentication for /api Management APIEPSS 1.0%CVE-2023-6942HIGHMissing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 VeEPSS 0.9%CVE-2025-22252CRITICALA missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FoEPSS 0.9%CVE-2020-3598MEDIUMCisco Vision Dynamic Signage Director Missing Authentication VulnerabilityEPSS 0.9%CVE-2021-47891CRITICALUnified Remote 3.9.0.2463 - Remote Code ExecutionEPSS 0.9%CVE-2026-2339HIGHRCE in TUBITAK BILGEM's LiderahenkEPSS 0.9%CVE-2025-21198CRITICALMicrosoft High Performance Compute (HPC) Pack Remote Code Execution VulnerabilityEPSS 0.9%