Fallos del tipo CWE-306

2605 resultados

Ausência de autenticação em funcionalidade crítica

A aplicação permite acesso a operações que exigem identidade verificada ou consomem recursos significativos sem validar quem está fazendo a requisição. Isso permite que qualquer pessoa, autenticada ou não, execute ações sensíveis — desde consumir quotas até acessar dados ou disparar processos custosos.

Ejemplo

Um serviço de relatórios expõe um endpoint `/gerar-relatorio` que processa grandes volumes de dados sem verificar credenciais. Um atacante chama o endpoint repetidas vezes, sobrecarregando a infraestrutura e causando negação de serviço, enquanto qualquer usuário consegue disparar operações com alto custo computacional.

Cómo mitigar

Implemente validação de autenticação (tokens JWT, OAuth, sessões) antes de executar qualquer operação sensível ou de alto custo. Combine com rate limiting e quotas por usuário para restringir abuso mesmo após autenticação.

CVE-2020-23256CRITICALAn issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code via unverified request to electerms service.EPSS 0.9%CVE-2026-26051CRITICALMobiliti e-mobi.hu Missing Authentication for Critical FunctionEPSS 0.9%CVE-2025-26361CRITICALA CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11EPSS 0.9%CVE-2021-22805—A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of EPSS 0.9%CVE-2026-1670CRITICALHoneywell CCTV Products Missing Authentication for Critical FunctionEPSS 0.8%CVE-2022-29879MEDIUMA vulnerability has been identified in SICAM T (All versions < V3.0). The web based management interface of affected devices does not employEPSS 0.8%CVE-2026-67594CRITICALSpikster Missing Authentication via API Route GroupEPSS 0.8%CVE-2024-21014CRITICALVulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: Simphony Enterprise Server). EPSS 0.8%CVE-2026-27897CRITICALVociferous Unauthenticated Remote Path Traversal (RCE via CSRF)EPSS 0.8%CVE-2026-40050CRITICALCrowdStrike LogScale Unauthenticated Path TraversalEPSS 0.8%CVE-2022-45498HIGHAn issue in the component tpi_systool_handle(0) (/goform/SysToolReboot) of Tenda W6-S v1.0.0.4(510) allows unauthenticated attackers to arbiEPSS 0.8%CVE-2023-31196HIGHMissing authentication for critical function in Wi-Fi AP UNIT allows a remote unauthenticated attacker to obtain sensitive information of thEPSS 0.8%CVE-2025-35051HIGHNewforma Project Center Server (NPCS) .NET unauthenticated deserializationEPSS 0.8%CVE-2026-86808MEDIUMmoltis-org moltis vault.rs vault_recovery_handler missing authenticationEPSS 0.8%CVE-2026-59822HIGHLiteLLM: MCP Authentication Bypass via OAuth2 Passthrough FallbackEPSS 0.8%KEVCVE-2022-3327MEDIUMMissing Authentication for Critical Function in ikus060/rdiffwebEPSS 0.8%CVE-2023-23545MEDIUMMissing authentication for critical function exists in T&D Corporation and ESPEC MIC CORP. data logger products, which may allow a remote unEPSS 0.8%CVE-2026-20223CRITICALCisco Secure Workload Unauthorized API Access VulnerabilityEPSS 0.8%CVE-2025-4018MEDIUM20120630 Novel-Plus CrawlController.java addCrawlSource missing authenticationEPSS 0.8%CVE-2026-60113CRITICALAIT-DSN < 2.2.2 Missing Authentication via SLE API RoutesEPSS 0.8%