Falhas do tipo CWE-306

3.055 resultados

Falta de autenticação em funcionalidades críticas

O software não valida a identidade do usuário antes de executar operações sensíveis ou que consomem recursos significativos (processamento, armazenamento, banda). Qualquer pessoa, autenticada ou não, consegue acessar e usar essas funcionalidades, criando risco de abuso, consumo não autorizado de recursos ou acesso a dados protegidos.

Exemplo

Uma API de relatórios que permite gerar análises pesadas sem verificar credenciais, permitindo um atacante disparar gerações de relatório em loop para derrubar o servidor. Ou um endpoint de backup que qualquer pessoa consegue chamar sem login, expondo dados sensíveis.

Como mitigar

Implemente verificação obrigatória de identidade (autenticação) em toda funcionalidade sensível ou cara computacionalmente. Use controles de sessão, tokens JWT ou OAuth, e combine com autorização (verificar se o usuário autenticado tem permissão específica para aquela ação).

CVE-2025-8286CRITICALGüralp Systems FMUS Series and MIN Series DevicesEPSS 1.4%CVE-2022-26067MEDIUMAn information disclosure vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS Platform EPSS 1.4%CVE-2020-6964—In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X EPSS 1.4%CVE-2022-29226CRITICALTrivial authentication bypass in EnvoyEPSS 1.4%CVE-2022-24829HIGHMissing authentication in GardenEPSS 1.4%CVE-2022-33138—A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SIMATIC MV550 H (All veEPSS 1.3%CVE-2026-42221HIGHnginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin ClaimEPSS 1.3%CVE-2021-44222—A vulnerability has been identified in SIMATIC eaSie Core Package (All versions < V22.00). The underlying MQTT service of affected systems dEPSS 1.3%CVE-2026-63722HIGHICEcoder 8.1 Unauthenticated RCE via terminal-xhr.phpEPSS 1.3%CVE-2022-29951CRITICALJTEKT TOYOPUC PLCs through 2022-04-29 mishandle authentication. They utilize the CMPLink/TCP protocol (configurable on ports 1024-65534 on eEPSS 1.3%CVE-2023-35830—STW (aka Sensor-Technik Wiedemann) TCG-4 Connectivity Module DeploymentPackage_v3.03r0-Impala and DeploymentPackage_v3.04r2-Jellyfish and TCEPSS 1.3%CVE-2023-29411CRITICAL A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow changes to administrative credentials, leadinEPSS 1.3%CVE-2026-76578CRITICALIpa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aciEPSS 1.3%CVE-2023-38186HIGHWindows Mobile Device Management Elevation of Privilege VulnerabilityEPSS 1.3%CVE-2023-23906HIGHMissing authentication for critical function exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote unautEPSS 1.3%CVE-2023-27060CRITICALLightCMS v1.3.7 was discovered to contain a remote code execution (RCE) vulnerability via the image:make function.EPSS 1.3%CVE-2025-12548CRITICALGithub.com/che-incubator/che-code: eclipse che — unauthenticated rce and secret exfiltration via tcp/3333EPSS 1.3%CVE-2022-20858CRITICALCisco Nexus Dashboard Unauthorized Access VulnerabilitiesEPSS 1.3%CVE-2022-38168CRITICALBroken Access Control in User Authentication in Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4 allows remote unauthenticated attackEPSS 1.3%CVE-2026-84731CRITICALPre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOSEPSS 1.3%