Fallos del tipo CWE-306

2608 resultados

Ausência de autenticação em funcionalidade crítica

A aplicação permite acesso a operações que exigem identidade verificada ou consomem recursos significativos sem validar quem está fazendo a requisição. Isso permite que qualquer pessoa, autenticada ou não, execute ações sensíveis — desde consumir quotas até acessar dados ou disparar processos custosos.

Ejemplo

Um serviço de relatórios expõe um endpoint `/gerar-relatorio` que processa grandes volumes de dados sem verificar credenciais. Um atacante chama o endpoint repetidas vezes, sobrecarregando a infraestrutura e causando negação de serviço, enquanto qualquer usuário consegue disparar operações com alto custo computacional.

Cómo mitigar

Implemente validação de autenticação (tokens JWT, OAuth, sessões) antes de executar qualquer operação sensível ou de alto custo. Combine com rate limiting e quotas por usuário para restringir abuso mesmo após autenticação.

CVE-2026-42074CRITICALOpenClaude: Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` InputEPSS 0.7%CVE-2024-8310CRITICALOPW Fuel Management Systems SiteSentinel Missing Authentication for Critical FunctionEPSS 0.7%CVE-2025-62586HIGHOPEXUS FOIAXpress unauthenticated administrator password resetEPSS 0.7%CVE-2025-68715CRITICALAn issue was discovered in Panda Wireless PWRU0 devices with firmware 2.2.9 that exposes multiple HTTP endpoints (/goform/setWan, /goform/seEPSS 0.7%CVE-2026-85695CRITICALFastChat Unauthenticated Worker Registration SSRF and Model SpoofingEPSS 0.7%CVE-2022-2474CRITICALAuthentication is currently unsupported in Haas Controller version 100.20.000.1110 when using the “Ethernet Q Commands” service, which allowEPSS 0.7%CVE-2023-49255CRITICALRouter console accessible without authenticationEPSS 0.7%CVE-2024-31218CRITICALMissing Authentication for Critical Function in Webhood backendEPSS 0.7%CVE-2026-40344HIGHMinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer UploadsEPSS 0.7%CVE-2026-7415CRITICALOpen MQTT orchestration without read/write ACLs in Yarbo robot firmwareEPSS 0.7%CVE-2026-90896HIGHMissing authentication in Ecommerce Template checkout session endpoint allows unauthenticated disclosure of buyer PIIEPSS 0.7%CVE-2026-7723MEDIUMPrefectHQ prefect WebSocket Endpoint in missing authenticationEPSS 0.7%CVE-2023-29413HIGH A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause Denial-of-Service when accessed by an unautheEPSS 0.7%CVE-2026-63087CRITICALGrafana OnCall 1.16.11 Unauthenticated Token Hijack via Plugin Install EndpointEPSS 0.7%CVE-2025-9152CRITICALImproper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR EndpointEPSS 0.7%CVE-2025-43428CRITICALA configuration issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOEPSS 0.7%CVE-2022-42970CRITICALA CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functionality that requires a pEPSS 0.7%CVE-2026-1840HIGHMissing authentication for critical function in Hubbell Aclara Metrum Cellular Web InterfaceEPSS 0.7%CVE-2021-37696HIGHSensitive information leak in MassDM of tmerc-cogsEPSS 0.7%CVE-2024-35277HIGHA missing authentication for critical function in Fortinet FortiPortal version 6.0.0 through 6.0.15, FortiManager version 7.4.0 through 7.4.EPSS 0.7%