Weaknesses of type CWE-306

2,592 results

Ausência de autenticação em funcionalidades críticas

A aplicação oferece funcionalidades sensíveis ou que consomem recursos significativos (processamento pesado, armazenamento, transações) sem verificar a identidade do usuário. Qualquer pessoa, autenticada ou não, consegue acessar e executar essas operações, comprometendo confidencialidade, integridade e disponibilidade.

Example

Um serviço de geração de relatórios expõe um endpoint `/api/gerar-relatorio` que não valida token JWT ou sessão — um atacante consegue disparar dezenas de requisições simultâneas, sobrecarregando o servidor, ou acessar dados de outros clientes sem se identificar.

How to mitigate

Implemente autenticação obrigatória antes de qualquer operação sensível (valide token, sessão ou credenciais). Para APIs, use OAuth2/JWT com verificação no início da requisição; para aplicações web, enforce sessão válida. Combine com rate limiting e quotas por usuário para conter abuso de recursos.

CVE-2026-45087CRITICALDalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server ModeEPSS 13.0%CVE-2018-5393—TP-Link EAP Controller versions 2.5.3 and earlier lack RMI authenticationEPSS 12.9%CVE-2021-22784—A CWE-306: Missing Authentication for Critical Function vulnerability exists in C-Bus Toolkit v1.15.8 and prior that could allow an attackerEPSS 12.1%CVE-2022-2138HIGHAdvantech iViewEPSS 11.3%CVE-2025-20702HIGHIn the Airoha Bluetooth audio SDK, there is a possible unauthorized access to the RACE protocol. This could lead to remote escalation of priEPSS 11.2%CVE-2026-25895CRITICALFUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload APIEPSS 11.2%CVE-2022-26925HIGHWindows LSA Spoofing VulnerabilityEPSS 10.7%KEVCVE-2024-45844HIGHBIG-IP monitors vulnerabilityEPSS 10.6%CVE-2019-3978—RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below allow remote unauthenticated attackers to trigger DNS queries via port 8291. ThEPSS 10.3%CVE-2026-27446CRITICALApache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federationEPSS 10.0%CVE-2026-25137CRITICALNixOs Odoo database and filestore publicly accessible with default odoo configurationEPSS 9.9%CVE-2024-12106CRITICALWhatsUp Gold - LDAP configuration interface leading to allowing attacker to configure LDAP settings without authenticationEPSS 9.7%CVE-2025-34102CRITICALCryptoLog Unauthenticated RCE via SQL Injection and Command InjectionEPSS 9.6%CVE-2025-20700HIGHIn the Airoha Bluetooth audio SDK, there is a possible permission bypass that allows access critical data of RACE protocol through BluetoothEPSS 9.0%CVE-2016-9369CRITICALAn issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions pEPSS 8.8%CVE-2024-24578CRITICALRaspberryMatic Unauthenticated Remote Code Execution vulnerability through HMServer File Upload EPSS 8.7%CVE-2025-34057HIGHRuijie NBR Router Administrative Credential DisclosureEPSS 8.7%CVE-2026-41179CRITICALRClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command executionEPSS 8.6%CVE-2023-27290CRITICALIBM Observability with Instana missing authenticationEPSS 8.6%CVE-2026-34472HIGHUnauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and V6.0.10P3N3_TE allows unauthenticated attacEPSS 8.5%