Falhas do tipo CWE-306

3.056 resultados

Falta de autenticação em funcionalidades críticas

O software não valida a identidade do usuário antes de executar operações sensíveis ou que consomem recursos significativos (processamento, armazenamento, banda). Qualquer pessoa, autenticada ou não, consegue acessar e usar essas funcionalidades, criando risco de abuso, consumo não autorizado de recursos ou acesso a dados protegidos.

Exemplo

Uma API de relatórios que permite gerar análises pesadas sem verificar credenciais, permitindo um atacante disparar gerações de relatório em loop para derrubar o servidor. Ou um endpoint de backup que qualquer pessoa consegue chamar sem login, expondo dados sensíveis.

Como mitigar

Implemente verificação obrigatória de identidade (autenticação) em toda funcionalidade sensível ou cara computacionalmente. Use controles de sessão, tokens JWT ou OAuth, e combine com autorização (verificar se o usuário autenticado tem permissão específica para aquela ação).

CVE-2023-33553CRITICALAn issue in Planet Technologies WDRT-1800AX v1.01-CP21 allows attackers to bypass authentication and escalate privileges to root via manipulEPSS 1.0%CVE-2026-120446HIGHmadong-admin-saas through 5.1.4 Missing Authentication via Platform Tenant Management APIEPSS 1.0%CVE-2025-27647CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Addition of Partial Admin Users WitEPSS 1.0%CVE-2021-1396CRITICALCisco Application Services Engine Unauthorized Access VulnerabilitiesEPSS 1.0%CVE-2020-3333MEDIUMCisco Application Services Engine Software Unauthenticated Event Policies Update VulnerabilityEPSS 1.0%CVE-2024-9164CRITICALMissing Authentication for Critical Function in GitLabEPSS 1.0%CVE-2026-18265CRITICALOSNEXUS QuantaStor Missing Authentication Remote Code Execution VulnerabilityEPSS 1.0%CVE-2026-12046CRITICALpgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection routes enables remote code executionEPSS 1.0%CVE-2026-57124CRITICALPraisonAI UI MCP connect endpoint allows unauthenticated local command executionEPSS 1.0%CVE-2019-13549—Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected syEPSS 1.0%CVE-2022-43999CRITICALAn issue was discovered in BACKCLICK Professional 5.9.63. Due to exposed CORBA management services, arbitrary system commands can be executeEPSS 1.0%CVE-2022-44000CRITICALAn issue was discovered in BACKCLICK Professional 5.9.63. Due to an exposed internal communications interface, it is possible to execute arbEPSS 1.0%CVE-2017-6873—A vulnerability was discovered in Siemens OZW672 (all versions) and OZW772 (all versions) that could allow an attacker to read and manipulatEPSS 1.0%CVE-2019-16004MEDIUMCisco Vision Dynamic Signage Director Authentication Bypass VulnerabilityEPSS 1.0%CVE-2026-105192CRITICALLMCache Unauthenticated RCE in multiprocess mode via pickle deserializationEPSS 1.0%CVE-2024-28179CRITICALJupyter Server Proxy's Websocket Proxying does not require authenticationEPSS 1.0%CVE-2022-3327MEDIUMMissing Authentication for Critical Function in ikus060/rdiffwebEPSS 1.0%CVE-2022-27623HIGHMissing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager (DSM) before 7.EPSS 1.0%CVE-2023-41187HIGHD-Link DAP-1325 HNAP Missing Authentication Remote Code Execution VulnerabilityEPSS 1.0%CVE-2026-56164MEDIUMMicrosoft SharePoint Server Elevation of Privilege VulnerabilityEPSS 1.0%KEV