Fallos del tipo CWE-306

2602 resultados

Ausência de autenticação em funcionalidade crítica

A aplicação permite acesso a operações que exigem identidade verificada ou consomem recursos significativos sem validar quem está fazendo a requisição. Isso permite que qualquer pessoa, autenticada ou não, execute ações sensíveis — desde consumir quotas até acessar dados ou disparar processos custosos.

Ejemplo

Um serviço de relatórios expõe um endpoint `/gerar-relatorio` que processa grandes volumes de dados sem verificar credenciais. Um atacante chama o endpoint repetidas vezes, sobrecarregando a infraestrutura e causando negação de serviço, enquanto qualquer usuário consegue disparar operações com alto custo computacional.

Cómo mitigar

Implemente validação de autenticação (tokens JWT, OAuth, sessões) antes de executar qualquer operação sensível ou de alto custo. Combine com rate limiting e quotas por usuário para restringir abuso mesmo após autenticação.

CVE-2025-5095CRITICALBurk Technology ARC Solo Missing Authentication for Critical FunctionEPSS 1.0%CVE-2023-25589CRITICALUnauthenticated Arbitrary User Creation Leads to Complete System CompromiseEPSS 1.0%CVE-2026-76578CRITICALIpa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aciEPSS 1.0%CVE-2026-50027CRITICALmcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/DeleteEPSS 1.0%CVE-2023-1096CRITICALSnapCenter versions 4.7 prior to 4.7P2 and 4.8 prior to 4.8P1 are susceptible to a vulnerability which could allow a remote unauthenticated EPSS 1.0%CVE-2026-57206HIGHSimpleChat plugin validation endpoints missing authentication and authorizationEPSS 1.0%CVE-2025-34414CRITICALEntrust Instant Financial Issuance (IFI) Legacy Remoting Service .NET Remoting RCEEPSS 1.0%CVE-2026-58115CRITICALA vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with NodEPSS 1.0%CVE-2023-21837HIGHVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected areEPSS 0.9%CVE-2023-6942HIGHMissing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 VeEPSS 0.9%CVE-2020-3598MEDIUMCisco Vision Dynamic Signage Director Missing Authentication VulnerabilityEPSS 0.9%CVE-2026-25505CRITICALBambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require AuthenticationEPSS 0.9%CVE-2022-1368CRITICALCognex 3D-A1000 Dimensioning System Missing Authentication for Critical FunctionEPSS 0.9%CVE-2025-22252CRITICALA missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FoEPSS 0.9%CVE-2026-64921HIGHMicrosoft SharePoint Server Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2025-21198CRITICALMicrosoft High Performance Compute (HPC) Pack Remote Code Execution VulnerabilityEPSS 0.9%CVE-2021-32659MEDIUMAutomatic room upgrade handling can be used maliciously to bridge a room non-consentuallyEPSS 0.9%CVE-2024-8751HIGHCVE-2024-8751EPSS 0.9%CVE-2024-38643CRITICALNotes Station 3EPSS 0.9%CVE-2023-40545HIGHPingFederate OAuth client_secret_jwt Authentication BypassEPSS 0.9%