Fallos del tipo CWE-306

2599 resultados

Ausência de autenticação em funcionalidade crítica

A aplicação permite acesso a operações que exigem identidade verificada ou consomem recursos significativos sem validar quem está fazendo a requisição. Isso permite que qualquer pessoa, autenticada ou não, execute ações sensíveis — desde consumir quotas até acessar dados ou disparar processos custosos.

Ejemplo

Um serviço de relatórios expõe um endpoint `/gerar-relatorio` que processa grandes volumes de dados sem verificar credenciais. Um atacante chama o endpoint repetidas vezes, sobrecarregando a infraestrutura e causando negação de serviço, enquanto qualquer usuário consegue disparar operações com alto custo computacional.

Cómo mitigar

Implemente validação de autenticação (tokens JWT, OAuth, sessões) antes de executar qualquer operação sensível ou de alto custo. Combine com rate limiting e quotas por usuário para restringir abuso mesmo após autenticação.

CVE-2026-45087CRITICALDalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server ModeEPSS 13.0%CVE-2018-5393—TP-Link EAP Controller versions 2.5.3 and earlier lack RMI authenticationEPSS 12.9%CVE-2021-22784—A CWE-306: Missing Authentication for Critical Function vulnerability exists in C-Bus Toolkit v1.15.8 and prior that could allow an attackerEPSS 12.1%CVE-2022-2138HIGHAdvantech iViewEPSS 11.3%CVE-2025-20702HIGHIn the Airoha Bluetooth audio SDK, there is a possible unauthorized access to the RACE protocol. This could lead to remote escalation of priEPSS 11.2%CVE-2026-25895CRITICALFUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload APIEPSS 11.2%CVE-2022-26925HIGHWindows LSA Spoofing VulnerabilityEPSS 10.7%KEVCVE-2024-45844HIGHBIG-IP monitors vulnerabilityEPSS 10.6%CVE-2019-3978—RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below allow remote unauthenticated attackers to trigger DNS queries via port 8291. ThEPSS 10.3%CVE-2026-27446CRITICALApache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federationEPSS 10.0%CVE-2026-25137CRITICALNixOs Odoo database and filestore publicly accessible with default odoo configurationEPSS 9.9%CVE-2024-12106CRITICALWhatsUp Gold - LDAP configuration interface leading to allowing attacker to configure LDAP settings without authenticationEPSS 9.7%CVE-2025-34102CRITICALCryptoLog Unauthenticated RCE via SQL Injection and Command InjectionEPSS 9.6%CVE-2025-20700HIGHIn the Airoha Bluetooth audio SDK, there is a possible permission bypass that allows access critical data of RACE protocol through BluetoothEPSS 9.0%CVE-2016-9369CRITICALAn issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions pEPSS 8.8%CVE-2024-24578CRITICALRaspberryMatic Unauthenticated Remote Code Execution vulnerability through HMServer File Upload EPSS 8.7%CVE-2025-34057HIGHRuijie NBR Router Administrative Credential DisclosureEPSS 8.7%CVE-2026-41179CRITICALRClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command executionEPSS 8.6%CVE-2023-27290CRITICALIBM Observability with Instana missing authenticationEPSS 8.6%CVE-2026-34472HIGHUnauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and V6.0.10P3N3_TE allows unauthenticated attacEPSS 8.5%