Falhas do tipo CWE-306

3.056 resultados

Falta de autenticação em funcionalidades críticas

O software não valida a identidade do usuário antes de executar operações sensíveis ou que consomem recursos significativos (processamento, armazenamento, banda). Qualquer pessoa, autenticada ou não, consegue acessar e usar essas funcionalidades, criando risco de abuso, consumo não autorizado de recursos ou acesso a dados protegidos.

Exemplo

Uma API de relatórios que permite gerar análises pesadas sem verificar credenciais, permitindo um atacante disparar gerações de relatório em loop para derrubar o servidor. Ou um endpoint de backup que qualquer pessoa consegue chamar sem login, expondo dados sensíveis.

Como mitigar

Implemente verificação obrigatória de identidade (autenticação) em toda funcionalidade sensível ou cara computacionalmente. Use controles de sessão, tokens JWT ou OAuth, e combine com autorização (verificar se o usuário autenticado tem permissão específica para aquela ação).

CVE-2026-18941HIGHFeast: feast-operator: feast: default authentication mode is no_auth — shared multi-tenant instances deployed without authenticationEPSS 0.9%CVE-2023-26573HIGHMissing Authentication In IDAttend’s IDWeb ApplicationEPSS 0.9%CVE-2026-57123CRITICALPraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired inEPSS 0.9%CVE-2023-44152MEDIUMSensitive information disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber ProtectEPSS 0.9%CVE-2016-9496—Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, lacks authentication to access certain pagesEPSS 0.9%CVE-2026-43920MEDIUMFOSSBilling: Unauthenticated update patcher endpoint allows remote maintenance executionEPSS 0.9%CVE-2026-70352CRITICALAzure AI Language Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2026-56163CRITICALMicrosoft Azure Kubernetes Service Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2025-27642CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Unauthenticated Driver Package EditEPSS 0.9%CVE-2026-57127CRITICALpraisonai: recipe serve auth middleware silently disables itself when no secret is setEPSS 0.9%CVE-2023-27571MEDIUMAn issue was discovered in DG3450 Cable Gateway AR01.02.056.18_041520_711.NCS.10. The troubleshooting_logs_download.php log file download fuEPSS 0.9%CVE-2025-32978HIGHQuest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 EPSS 0.9%CVE-2019-10915—A vulnerability has been identified in TIA Administrator (All versions < V1.0 SP1 Upd1). The integrated configuration web application (TIA AEPSS 0.9%CVE-2021-34870MEDIUMThis vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR XR1000 1.0.0.52_EPSS 0.9%CVE-2026-26051CRITICALMobiliti e-mobi.hu Missing Authentication for Critical FunctionEPSS 0.9%CVE-2020-23256CRITICALAn issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code via unverified request to electerms service.EPSS 0.9%CVE-2026-111322CRITICALArchon 0.2.13 through 0.11.1 Missing Authentication via /api/* Control APIEPSS 0.9%CVE-2020-27285MEDIUMThe default configuration of Crimson 3.1 (Build versions prior to 3119.001) allows a user to be able to read and modify the database withoutEPSS 0.9%CVE-2026-48252HIGHAdobe Experience Manager | Missing Authentication for Critical Function (CWE-306)EPSS 0.9%CVE-2024-33616MEDIUMAdmin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrative privilege. SharpEPSS 0.9%