Fallos del tipo CWE-306

2619 resultados

Ausência de autenticação em funcionalidade crítica

A aplicação permite acesso a operações que exigem identidade verificada ou consomem recursos significativos sem validar quem está fazendo a requisição. Isso permite que qualquer pessoa, autenticada ou não, execute ações sensíveis — desde consumir quotas até acessar dados ou disparar processos custosos.

Ejemplo

Um serviço de relatórios expõe um endpoint `/gerar-relatorio` que processa grandes volumes de dados sem verificar credenciais. Um atacante chama o endpoint repetidas vezes, sobrecarregando a infraestrutura e causando negação de serviço, enquanto qualquer usuário consegue disparar operações com alto custo computacional.

Cómo mitigar

Implemente validação de autenticação (tokens JWT, OAuth, sessões) antes de executar qualquer operação sensível ou de alto custo. Combine com rate limiting e quotas por usuário para restringir abuso mesmo após autenticação.

CVE-2025-6678HIGHAutel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure VulnerabilityEPSS 0.5%CVE-2026-31245MEDIUMThe mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint (POST /memories). The endpoint alEPSS 0.5%CVE-2022-50978HIGHMultiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via Modbus (TCP)EPSS 0.5%CVE-2021-46852HIGHThe memory management module has the logic bypass vulnerability. Successful exploitation of this vulnerability may affect data confidentialiEPSS 0.5%CVE-2024-35294MEDIUMSchneider Elektronik Series 700 prone to missing authentication for traffic capture functionEPSS 0.5%CVE-2026-66139MEDIUMOpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known.EPSS 0.5%CVE-2026-27603HIGHChartbrew: Unauthenticated Chart Filter Endpoint: POST /project/:project_id/chart/:chart_id/filter missing verifyToken + checkPermissionsEPSS 0.5%CVE-2025-54942CRITICALSUNNET Corporate Training Management System - Missing Authentication for Critical FunctionEPSS 0.5%CVE-2025-54816CRITICALEVMAPA Missing Authentication for Critical FunctionEPSS 0.5%CVE-2022-32528HIGH A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause access to manipulate and read specific files EPSS 0.5%CVE-2026-30799MEDIUMMissing Authentication for Critical Function vulnerability in RTI Connext Professional (Security Plugins) allows Identity Spoofing.EPSS 0.5%CVE-2026-44025HIGHFluentd: Exposure of Sensitive Information via Monitor Agent APIEPSS 0.5%CVE-2021-31868MEDIUMRapid7 Nexpose Security Console Ticket Access Authentication VulnerabilityEPSS 0.5%CVE-2026-42222HIGHnginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeoverEPSS 0.5%CVE-2026-61344MEDIUMSuperior Court of California Hearing Reminder Service unauthenticated information disclosureEPSS 0.5%CVE-2026-29606MEDIUMOpenClaw < 2026.2.14 - Webhook Signature Verification Bypass via ngrok Loopback CompatibilityEPSS 0.5%CVE-2025-5871MEDIUMPapendorf SOL Connect Center Web Interface missing authenticationEPSS 0.5%CVE-2021-47727HIGHSelea Targa IP Camera Unauthenticated Stream DisclosureEPSS 0.5%CVE-2026-9212MEDIUMInsufficient authentication and input validation in certain NETGEAR productsEPSS 0.5%CVE-2025-5872MEDIUMeGauge EG3000 Energy Monitor Setting missing authenticationEPSS 0.5%