Weaknesses of type CWE-306

2,599 results

Ausência de autenticação em funcionalidades críticas

A aplicação oferece funcionalidades sensíveis ou que consomem recursos significativos (processamento pesado, armazenamento, transações) sem verificar a identidade do usuário. Qualquer pessoa, autenticada ou não, consegue acessar e executar essas operações, comprometendo confidencialidade, integridade e disponibilidade.

Example

Um serviço de geração de relatórios expõe um endpoint `/api/gerar-relatorio` que não valida token JWT ou sessão — um atacante consegue disparar dezenas de requisições simultâneas, sobrecarregando o servidor, ou acessar dados de outros clientes sem se identificar.

How to mitigate

Implemente autenticação obrigatória antes de qualquer operação sensível (valide token, sessão ou credenciais). Para APIs, use OAuth2/JWT com verificação no início da requisição; para aplicações web, enforce sessão válida. Combine com rate limiting e quotas por usuário para conter abuso de recursos.

CVE-2023-4699CRITICALArbitrary Command Execution Vulnerability in Mitsubishi Electric proprietary protocol communication of multiple FA productsEPSS 0.7%CVE-2026-22238CRITICALAdministrator Account Creation Vulnerability in BLUVOYIXEPSS 0.7%CVE-2026-58319CRITICALApache Doris: Improper Authentication in Frontend HTTP APIEPSS 0.7%CVE-2026-44090CRITICALMissing authentication for MQTT BrokerEPSS 0.7%CVE-2026-44101CRITICALOCPP reconfiguration vulnerabilityEPSS 0.7%CVE-2025-65856CRITICALAuthentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthentiEPSS 0.7%CVE-2026-85637MEDIUMjofpin trape Admin Endpoint sockets.py join_room missing authenticationEPSS 0.7%CVE-2025-34231HIGHVasion Print (formerly PrinterLogic) SSRF via HP badgeSetup.phpEPSS 0.7%CVE-2026-31242CRITICALThe mem0 v1.0.0 server lacks authentication and authorization controls for its memory reset functionality accessible via the DELETE /memorieEPSS 0.7%CVE-2026-31882HIGHDagu SSE Authentication Bypass in Basic Auth ModeEPSS 0.7%CVE-2025-61945CRITICALMissing Authentication for Critical Function in Radiometrics VizAirEPSS 0.7%CVE-2022-45138CRITICALWAGO: Missing Authentication for Critical FunctionEPSS 0.7%CVE-2022-20830MEDIUMCisco Software-Defined Application Visibility and Control on Cisco vManage Authentication Bypass VulnerabilityEPSS 0.7%CVE-2026-5057HIGHATEN Unizon RpcProvider Missing Authentication Denial-of-Service VulnerabilityEPSS 0.7%CVE-2023-21842HIGHVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affEPSS 0.7%CVE-2025-21559MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8EPSS 0.7%CVE-2019-5164HIGHAn exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev 3.3.2. Specially crafted network packets seEPSS 0.7%CVE-2023-30762CRITICALImproper authentication vulnerability exists in KB-AHR series and KB-IRIP series. If this vulnerability is exploited, an arbitrary OS commanEPSS 0.7%CVE-2025-34070CRITICALGFI Kerio Control GFIAgent Missing Authentication on Administrative InterfacesEPSS 0.7%CVE-2022-41644HIGH Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lacks authentication for a function that changes group privilegesEPSS 0.7%