Weaknesses of type CWE-306

2,610 results

Ausência de autenticação em funcionalidades críticas

A aplicação oferece funcionalidades sensíveis ou que consomem recursos significativos (processamento pesado, armazenamento, transações) sem verificar a identidade do usuário. Qualquer pessoa, autenticada ou não, consegue acessar e executar essas operações, comprometendo confidencialidade, integridade e disponibilidade.

Example

Um serviço de geração de relatórios expõe um endpoint `/api/gerar-relatorio` que não valida token JWT ou sessão — um atacante consegue disparar dezenas de requisições simultâneas, sobrecarregando o servidor, ou acessar dados de outros clientes sem se identificar.

How to mitigate

Implemente autenticação obrigatória antes de qualquer operação sensível (valide token, sessão ou credenciais). Para APIs, use OAuth2/JWT com verificação no início da requisição; para aplicações web, enforce sessão válida. Combine com rate limiting e quotas por usuário para conter abuso de recursos.

CVE-2025-29870HIGHMissing authentication for critical function vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote unauthenticaEPSS 0.6%CVE-2026-3207HIGHTIBCO BPM Enterprise Remote Code Execution (RCE) VulnerabilityEPSS 0.6%CVE-2026-66006MEDIUMlakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefsEPSS 0.6%CVE-2026-72822HIGHGrav before 1.0.13 Authentication Bypass via disable2faEPSS 0.6%CVE-2025-34039CRITICALYonyou NC BeanShell Command InjectionEPSS 0.6%CVE-2025-30135CRITICALAn issue was discovered on IROAD Dashcam FX2 devices. Dumping Files Over HTTP and RTSP Without Authentication can occur. It lacks authenticaEPSS 0.6%CVE-2025-24924CRITICALGMOD Apollo Missing Authentication for Critical FunctionEPSS 0.6%CVE-2023-6368MEDIUMWhatsUp Gold Unauthenticated Access to an API EndpointEPSS 0.6%CVE-2026-48325CRITICALColdFusion | Missing Authentication for Critical Function (CWE-306)EPSS 0.6%CVE-2025-3461CRITICALON Semiconductor Quantenna Telnet Missing AuthenticationEPSS 0.6%CVE-2024-1491HIGHElectrolink FM/DAB/TV Transmitter Missing Authentication for Critical FunctionEPSS 0.6%CVE-2026-53952CRITICALGetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic FlawEPSS 0.6%CVE-2026-47837MEDIUMSpring Cloud Config Server Monitor Endpoint Does Not Validate Webhook RequestsEPSS 0.6%CVE-2026-86728HIGHAVideo through 29.0 Unauthenticated Disclosure via epg.json.phpEPSS 0.6%CVE-2025-63390MEDIUMAn authentication bypass vulnerability exists in AnythingLLM v1.8.5 in via the /api/workspaces endpoint. The endpoint fails to implement proEPSS 0.6%CVE-2025-15683HIGHMultiple Unauthenticated Denial-of-Service ConditionsEPSS 0.6%CVE-2026-31244MEDIUMThe mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories/{memory_id}). TEPSS 0.6%CVE-2025-34232MEDIUMVasion Print (formerly PrinterLogic) Blind SSRF via Lexmark dellCheck.phpEPSS 0.6%CVE-2024-23815HIGHA vulnerability has been identified in Desigo CC (All versions if access from Installed Clients to Desigo CC server is allowed from networksEPSS 0.6%CVE-2026-31241MEDIUMThe mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories). The endpoint EPSS 0.6%