Fallos del tipo CWE-306

3079 resultados

Ausência de autenticação em funcionalidade crítica

A aplicação permite acesso a operações que exigem identidade verificada ou consomem recursos significativos sem validar quem está fazendo a requisição. Isso permite que qualquer pessoa, autenticada ou não, execute ações sensíveis — desde consumir quotas até acessar dados ou disparar processos custosos.

Ejemplo

Um serviço de relatórios expõe um endpoint `/gerar-relatorio` que processa grandes volumes de dados sem verificar credenciais. Um atacante chama o endpoint repetidas vezes, sobrecarregando a infraestrutura e causando negação de serviço, enquanto qualquer usuário consegue disparar operações com alto custo computacional.

Cómo mitigar

Implemente validação de autenticação (tokens JWT, OAuth, sessões) antes de executar qualquer operação sensível ou de alto custo. Combine com rate limiting e quotas por usuário para restringir abuso mesmo após autenticação.

CVE-2021-22652—Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attacEPSS 36.8%CVE-2023-20126CRITICALCisco SPA112 2-Port Phone Adapters Remote Command Execution VulnerabilityEPSS 36.7%CVE-2024-6842HIGHExposure of Sensitive Information in mintplex-labs/anything-llmEPSS 36.3%CVE-2023-51587HIGHVoltronic Power ViewPower getModbusPassword Missing Authentication Information Disclosure VulnerabilityEPSS 36.0%CVE-2026-33032CRITICALNginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx TakeoverEPSS 35.3%CVE-2025-53118CRITICALSecurden Unified PAM Authentication BypassEPSS 35.1%CVE-2026-21445HIGHLangflow Missing Authentication on Critical API EndpointsEPSS 33.3%CVE-2026-41176CRITICALRclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command executionEPSS 32.7%CVE-2026-44338HIGHPraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow executionEPSS 32.6%CVE-2024-12847CRITICALNETGEAR DGN setup.cgi OS Command InjectionEPSS 30.4%CVE-2024-50630HIGHMissing authentication for critical function vulnerability in the webapi component in Synology Drive Server before 3.0.4-12699, 3.2.1-23280,EPSS 24.6%CVE-2022-45551CRITICALAn issue discovered in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to escalate privileges via WGET command tEPSS 23.6%CVE-2026-27944CRITICALNginx UI: Unauthenticated Backup Download with Encryption Key DisclosureEPSS 22.8%CVE-2020-24363HIGHTP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request EPSS 22.2%KEVCVE-2026-33340CRITICALLoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpointEPSS 21.6%CVE-2021-22823—A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of EPSS 21.4%CVE-2025-58443CRITICALFOG's authentication bypass leads to full SQL DB dumpEPSS 21.3%CVE-2025-34117CRITICALNetcore / Netis Routers RCE via UDP Port 53413 BackdoorEPSS 20.8%CVE-2026-22679CRITICALWeaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug EndpointEPSS 20.7%CVE-2026-8732CRITICALWP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX ActionEPSS 20.4%