Falhas do tipo CWE-306

3.056 resultados

Falta de autenticação em funcionalidades críticas

O software não valida a identidade do usuário antes de executar operações sensíveis ou que consomem recursos significativos (processamento, armazenamento, banda). Qualquer pessoa, autenticada ou não, consegue acessar e usar essas funcionalidades, criando risco de abuso, consumo não autorizado de recursos ou acesso a dados protegidos.

Exemplo

Uma API de relatórios que permite gerar análises pesadas sem verificar credenciais, permitindo um atacante disparar gerações de relatório em loop para derrubar o servidor. Ou um endpoint de backup que qualquer pessoa consegue chamar sem login, expondo dados sensíveis.

Como mitigar

Implemente verificação obrigatória de identidade (autenticação) em toda funcionalidade sensível ou cara computacionalmente. Use controles de sessão, tokens JWT ou OAuth, e combine com autorização (verificar se o usuário autenticado tem permissão específica para aquela ação).

CVE-2023-39466MEDIUMTriangle MicroWorks SCADA Data Gateway get_config Missing Authentication Information Disclosure VulnerabilityEPSS 1.0%CVE-2025-34068CRITICALSamsung WLAN AP WEA453e < 5.2.4.T1 Unauthenticated RCE via command1 and command2 ParametersEPSS 1.0%CVE-2021-26928MEDIUMBIRD through 2.0.7 does not provide functionality for password authentication of BGP peers. Because of this, products that use BIRD (which mEPSS 1.0%CVE-2025-34218CRITICALVasion Print (formerly PrinterLogic) Exposed Internal Docker InstanceEPSS 1.0%CVE-2026-27182HIGHSaturn Remote Mouse Server UDP Command Injection RCEEPSS 1.0%CVE-2020-14140HIGHWhen Xiaomi router firmware is updated in 2020, there is an unauthenticated API that can reveal WIFI password vulnerability. This vulnerabilEPSS 1.0%CVE-2022-1368CRITICALCognex 3D-A1000 Dimensioning System Missing Authentication for Critical FunctionEPSS 1.0%CVE-2020-10754MEDIUMIt was found that nmcli, a command line interface to NetworkManager did not honour 802-1x.ca-path and 802-1x.phase2-ca-path settings, when cEPSS 1.0%CVE-2026-105728HIGHDynamics Business Central Information Disclosure VulnerabilityEPSS 1.0%CVE-2022-43990HIGHPassword recovery vulnerability in SICK SIM1012 Partnumber 1098146 with firmware version <2.2.0 allows an unprivileged remote attacker to gaEPSS 1.0%CVE-2022-43989HIGHPassword recovery vulnerability in SICK SIM2x00 (ARM) Partnumber 1092673 and 1081902 with firmware version < 1.2.0 allows an unprivileged reEPSS 1.0%CVE-2016-10364—With X-Pack installed, Kibana versions 5.0.0 and 5.0.1 were not properly authenticating requests to advanced settings and the short URL servEPSS 1.0%CVE-2026-86124CRITICALAutoAgent Unauthenticated Remote Code Execution via the Sandbox TCP Command ServerEPSS 1.0%CVE-2023-22441HIGHMissing authentication for critical function exists in Seiko Solutions SkyBridge series, which may allow a remote attacker to obtain or alteEPSS 1.0%CVE-2023-53964HIGHSOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Factory Reset VulnerabilityEPSS 1.0%CVE-2026-22552CRITICALePower epower.ie Missing Authentication for Critical FunctionEPSS 1.0%CVE-2024-36445CRITICALSwissphone DiCal-RED 4009 devices allow a remote attacker to gain a root shell via TELNET without authentication.EPSS 1.0%CVE-2026-121933CRITICALLinksys E5350 Setup Wizard apply.cgi save_settings missing authenticationEPSS 1.0%CVE-2022-44013CRITICALAn issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can make various API calls without authentication because the EPSS 1.0%CVE-2026-68502CRITICALLazyOwn: Unauthenticated Socket.IO `input` Event Reaches LazyOwn Command Dispatcher — Unauthenticated RCEEPSS 1.0%