Weaknesses of type CWE-306

2,611 results

Ausência de autenticação em funcionalidades críticas

A aplicação oferece funcionalidades sensíveis ou que consomem recursos significativos (processamento pesado, armazenamento, transações) sem verificar a identidade do usuário. Qualquer pessoa, autenticada ou não, consegue acessar e executar essas operações, comprometendo confidencialidade, integridade e disponibilidade.

Example

Um serviço de geração de relatórios expõe um endpoint `/api/gerar-relatorio` que não valida token JWT ou sessão — um atacante consegue disparar dezenas de requisições simultâneas, sobrecarregando o servidor, ou acessar dados de outros clientes sem se identificar.

How to mitigate

Implemente autenticação obrigatória antes de qualquer operação sensível (valide token, sessão ou credenciais). Para APIs, use OAuth2/JWT com verificação no início da requisição; para aplicações web, enforce sessão válida. Combine com rate limiting e quotas por usuário para conter abuso de recursos.

CVE-2026-53981HIGHCap-go < v12.128.2 Account Takeover via Unauthenticated Email Change MechanismEPSS 0.5%CVE-2021-46852HIGHThe memory management module has the logic bypass vulnerability. Successful exploitation of this vulnerability may affect data confidentialiEPSS 0.5%CVE-2022-50978HIGHMultiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via Modbus (TCP)EPSS 0.5%CVE-2026-31245MEDIUMThe mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint (POST /memories). The endpoint alEPSS 0.5%CVE-2024-35294MEDIUMSchneider Elektronik Series 700 prone to missing authentication for traffic capture functionEPSS 0.5%CVE-2026-66139MEDIUMOpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known.EPSS 0.5%CVE-2026-27603HIGHChartbrew: Unauthenticated Chart Filter Endpoint: POST /project/:project_id/chart/:chart_id/filter missing verifyToken + checkPermissionsEPSS 0.5%CVE-2025-54942CRITICALSUNNET Corporate Training Management System - Missing Authentication for Critical FunctionEPSS 0.5%CVE-2025-54816CRITICALEVMAPA Missing Authentication for Critical FunctionEPSS 0.5%CVE-2026-30799MEDIUMMissing Authentication for Critical Function vulnerability in RTI Connext Professional (Security Plugins) allows Identity Spoofing.EPSS 0.5%CVE-2022-32528HIGH A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause access to manipulate and read specific files EPSS 0.5%CVE-2026-42222HIGHnginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeoverEPSS 0.5%CVE-2021-31868MEDIUMRapid7 Nexpose Security Console Ticket Access Authentication VulnerabilityEPSS 0.5%CVE-2026-44025HIGHFluentd: Exposure of Sensitive Information via Monitor Agent APIEPSS 0.5%CVE-2025-5871MEDIUMPapendorf SOL Connect Center Web Interface missing authenticationEPSS 0.5%CVE-2026-61344MEDIUMSuperior Court of California Hearing Reminder Service unauthenticated information disclosureEPSS 0.5%CVE-2026-29606MEDIUMOpenClaw < 2026.2.14 - Webhook Signature Verification Bypass via ngrok Loopback CompatibilityEPSS 0.5%CVE-2026-9212MEDIUMInsufficient authentication and input validation in certain NETGEAR productsEPSS 0.5%CVE-2021-47727HIGHSelea Targa IP Camera Unauthenticated Stream DisclosureEPSS 0.5%CVE-2026-34839HIGHGlances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORSEPSS 0.5%