Fallos del tipo CWE-306

2599 resultados

Ausência de autenticação em funcionalidade crítica

A aplicação permite acesso a operações que exigem identidade verificada ou consomem recursos significativos sem validar quem está fazendo a requisição. Isso permite que qualquer pessoa, autenticada ou não, execute ações sensíveis — desde consumir quotas até acessar dados ou disparar processos custosos.

Ejemplo

Um serviço de relatórios expõe um endpoint `/gerar-relatorio` que processa grandes volumes de dados sem verificar credenciais. Um atacante chama o endpoint repetidas vezes, sobrecarregando a infraestrutura e causando negação de serviço, enquanto qualquer usuário consegue disparar operações com alto custo computacional.

Cómo mitigar

Implemente validação de autenticação (tokens JWT, OAuth, sessões) antes de executar qualquer operação sensível ou de alto custo. Combine com rate limiting e quotas por usuário para restringir abuso mesmo após autenticação.

CVE-2023-20126CRITICALCisco SPA112 2-Port Phone Adapters Remote Command Execution VulnerabilityEPSS 36.7%CVE-2026-33032CRITICALNginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx TakeoverEPSS 36.3%CVE-2026-30824HIGHFlowise: Missing Authentication on NVIDIA NIM EndpointsEPSS 36.3%CVE-2023-51587HIGHVoltronic Power ViewPower getModbusPassword Missing Authentication Information Disclosure VulnerabilityEPSS 36.0%CVE-2026-21445HIGHLangflow Missing Authentication on Critical API EndpointsEPSS 33.7%CVE-2026-41176CRITICALRclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command executionEPSS 32.7%CVE-2024-6842HIGHExposure of Sensitive Information in mintplex-labs/anything-llmEPSS 31.1%CVE-2025-53118CRITICALSecurden Unified PAM Authentication BypassEPSS 30.5%CVE-2024-12847CRITICALNETGEAR DGN setup.cgi OS Command InjectionEPSS 29.9%CVE-2026-44338HIGHPraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow executionEPSS 28.6%CVE-2025-34117CRITICALNetcore / Netis Routers RCE via UDP Port 53413 BackdoorEPSS 27.4%CVE-2026-56164MEDIUMMicrosoft SharePoint Server Elevation of Privilege VulnerabilityEPSS 26.6%KEVCVE-2024-50630HIGHMissing authentication for critical function vulnerability in the webapi component in Synology Drive Server before 3.0.4-12699, 3.2.1-23280,EPSS 24.6%CVE-2022-45551CRITICALAn issue discovered in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to escalate privileges via WGET command tEPSS 23.6%CVE-2026-8732CRITICALWP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX ActionEPSS 22.7%CVE-2026-27944CRITICALNginx UI: Unauthenticated Backup Download with Encryption Key DisclosureEPSS 22.2%CVE-2026-33340CRITICALLoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpointEPSS 21.6%CVE-2021-22823—A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of EPSS 21.4%CVE-2020-24363HIGHTP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request EPSS 20.7%KEVCVE-2026-22679CRITICALWeaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug EndpointEPSS 20.4%