Weaknesses of type CWE-306

3,054 results

Ausência de autenticação em funcionalidades críticas

A aplicação oferece funcionalidades sensíveis ou que consomem recursos significativos (processamento pesado, armazenamento, transações) sem verificar a identidade do usuário. Qualquer pessoa, autenticada ou não, consegue acessar e executar essas operações, comprometendo confidencialidade, integridade e disponibilidade.

Example

Um serviço de geração de relatórios expõe um endpoint `/api/gerar-relatorio` que não valida token JWT ou sessão — um atacante consegue disparar dezenas de requisições simultâneas, sobrecarregando o servidor, ou acessar dados de outros clientes sem se identificar.

How to mitigate

Implemente autenticação obrigatória antes de qualquer operação sensível (valide token, sessão ou credenciais). Para APIs, use OAuth2/JWT com verificação no início da requisição; para aplicações web, enforce sessão válida. Combine com rate limiting e quotas por usuário para conter abuso de recursos.

CVE-2021-22652—Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attacEPSS 36.8%CVE-2023-20126CRITICALCisco SPA112 2-Port Phone Adapters Remote Command Execution VulnerabilityEPSS 36.7%CVE-2024-6842HIGHExposure of Sensitive Information in mintplex-labs/anything-llmEPSS 36.3%CVE-2023-51587HIGHVoltronic Power ViewPower getModbusPassword Missing Authentication Information Disclosure VulnerabilityEPSS 36.0%CVE-2026-33032CRITICALNginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx TakeoverEPSS 35.3%CVE-2025-53118CRITICALSecurden Unified PAM Authentication BypassEPSS 35.1%CVE-2026-21445HIGHLangflow Missing Authentication on Critical API EndpointsEPSS 33.3%CVE-2026-41176CRITICALRclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command executionEPSS 32.7%CVE-2026-44338HIGHPraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow executionEPSS 32.6%CVE-2024-12847CRITICALNETGEAR DGN setup.cgi OS Command InjectionEPSS 30.4%CVE-2024-50630HIGHMissing authentication for critical function vulnerability in the webapi component in Synology Drive Server before 3.0.4-12699, 3.2.1-23280,EPSS 24.6%CVE-2022-45551CRITICALAn issue discovered in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to escalate privileges via WGET command tEPSS 23.6%CVE-2026-27944CRITICALNginx UI: Unauthenticated Backup Download with Encryption Key DisclosureEPSS 22.8%CVE-2020-24363HIGHTP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request EPSS 22.2%KEVCVE-2026-33340CRITICALLoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpointEPSS 21.6%CVE-2021-22823—A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of EPSS 21.4%CVE-2025-58443CRITICALFOG's authentication bypass leads to full SQL DB dumpEPSS 21.3%CVE-2025-34117CRITICALNetcore / Netis Routers RCE via UDP Port 53413 BackdoorEPSS 20.8%CVE-2026-22679CRITICALWeaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug EndpointEPSS 20.7%CVE-2026-8732CRITICALWP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX ActionEPSS 20.4%