Fallos del tipo CWE-306

2632 resultados

Ausência de autenticação em funcionalidade crítica

A aplicação permite acesso a operações que exigem identidade verificada ou consomem recursos significativos sem validar quem está fazendo a requisição. Isso permite que qualquer pessoa, autenticada ou não, execute ações sensíveis — desde consumir quotas até acessar dados ou disparar processos custosos.

Ejemplo

Um serviço de relatórios expõe um endpoint `/gerar-relatorio` que processa grandes volumes de dados sem verificar credenciais. Um atacante chama o endpoint repetidas vezes, sobrecarregando a infraestrutura e causando negação de serviço, enquanto qualquer usuário consegue disparar operações com alto custo computacional.

Cómo mitigar

Implemente validação de autenticação (tokens JWT, OAuth, sessões) antes de executar qualquer operação sensível ou de alto custo. Combine com rate limiting e quotas por usuário para restringir abuso mesmo após autenticação.

CVE-2025-71409HIGHNo Authentication for Very High Frequency Data Link messages used in CPDLCEPSS 0.3%CVE-2021-20262—A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password. This flaw allows an attacker to takeEPSS 0.3%CVE-2026-26048HIGHJinan USR IOT Technology Limited (PUSR) USR-W610 Missing Authentication for Critical FunctionEPSS 0.3%CVE-2026-3527MEDIUMAJAX Dashboard - Critical - Access bypass - SA-CONTRIB-2026-022EPSS 0.3%CVE-2025-56562HIGHAn incorrect API discovered in Signify Wiz Connected 1.9.1 allows attackers to remotely launch a DoS on Wiz devices only requiring the MAC aEPSS 0.3%CVE-2026-36603HIGHMercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions without authentication on port 1900, incluEPSS 0.3%CVE-2026-73245MEDIUMKestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-authEPSS 0.3%CVE-2025-25736MEDIUMKapsch TrafficCom RIS-9260 RSU LEO v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to contain Android Debug Bridge (ADB) pEPSS 0.3%CVE-2026-52480MEDIUMAn issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the inetd serviceEPSS 0.3%CVE-2024-48953HIGHAn issue was discovered in Logpoint before 7.5.0. Endpoints for creating, editing, or deleting third-party authentication modules lacked proEPSS 0.3%CVE-2021-34983MEDIUMNETGEAR Multiple Routers httpd Missing Authentication for Critical Function Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-12199HIGHUnauthenticated Denial of Service in nltk.app.wordnet_appEPSS 0.3%CVE-2026-43881MEDIUMWWBN AVideo: Unauthenticated User Enumeration in `objects/users.json.php` via `isCompany` Parameter Flips `$ignoreAdmin = true` and Defeats Admin-Only Listing GuardEPSS 0.3%CVE-2026-0492HIGHPrivilege escalation vulnerability in SAP HANA databaseEPSS 0.3%CVE-2018-25140CRITICALFLIR Thermal Traffic Cameras V1.01-0bb5b27 Unauthenticated Websocket Device ManipulationEPSS 0.3%CVE-2022-48496—Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause maEPSS 0.3%CVE-2026-76439MEDIUMCisco Identity Services Engine Event Injection VulnerabilityEPSS 0.3%CVE-2026-54367HIGHCentreStack < 17.2 Unauthenticated API Authorization BypassEPSS 0.3%CVE-2026-66098HIGHMira Hormone Monitor, Mira Android App Missing authentication for critical functionEPSS 0.3%CVE-2022-48494—Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause maEPSS 0.3%