Weakness (CWE)
CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability.
Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port.
In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate credential management need to be used throughout.
-
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
-
Architecture and Design
Where possible, avoid implementing custom, "grow-your-own" authentication routines and consider using authentication capabilities as provided by the surrounding framework, operating system, or environment. These capabilities may avoid common weaknesses that are unique to authentication; support automatic auditing and tracking; and make it easier to provide a clear separation between authentication tasks and authorization tasks.
In environments such as the World Wide Web, the line between authentication and authorization is sometimes blurred. If custom authentication routines are required instead of those provided by the server, then these routines must be applied to every single page, since these pages could be requested directly.
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator [REF-45].
-
Implementation, System Configuration, Operation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to require strong authentication for users who should be allowed to access the data [REF-1297] [REF-1298] [REF-1302].
Source: MITRE CWE-306
1,266 results · Clear filters · Feed
-
High 8.8
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that …
-
High 8.8
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that …
-
High 7.5
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported…
-
High 8.1
Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package).…
-
High 8.1
Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Performance Monitor)…
-
High 8.1
Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Application Server).…
-
High 8.2
Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package).…
-
High 8.8
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported vers…
-
High 8.8
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Security). Supported versions tha…
-
High 8.8
Rockwell Automation FLEX I/O Dual-port EtherNet/IP Adapters – Multiple Vulnerabilities
An improper authentication security issue exists within the 1794-AENTR adapter's embedded web server. The vulnerability allows an unauthenticated attacker to change the device's web interface password by sending a crafted HTTP GET request to a specific endpoi…
-
High 7.5
WordPress CherryFramework Themes 3.1.4 Backup File Download
WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to download sensitive backup files by accessing the download_backup.php endpoint. Attackers can directly access the download_backup.p…
-
High 7.5
Capgo < 12.128.2 - Denial of Service via Unverified Email Account Registration and Deletion
Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register accounts using arbitrary email addresses without verification, then initiate deletion to lock emails in pending deletion state. Attackers can permanently lock legi…
-
High 8.7
Missing Authentication for Critical Function in @agenticmail/mcp
AgenticMail gives AI agents real email addresses and phone numbers. Prior to version 0.9.27, @agenticmail/mcp exposes a Streamable HTTP transport when started with --http or MCP_HTTP=1. In that mode, the /mcp endpoint accepts requests without any HTTP authent…
-
High 7.6
Cap-go < v12.128.2 Account Takeover via Unauthenticated Email Change Mechanism
Cap-go prior to 12.128.2 contains an account takeover vulnerability in its email change mechanism that allows an attacker with temporary authenticated session access to change the registered email address without re-authentication such as password or MFA veri…
-
High 8.6
Aqara Board IoT insecure debug API
The Aqara Board service (op-test.aqara.com) accepts arbitrary MQTT command payloads, and forwards them to the platfom's HiveMQ broker without authentication. This is an instance of "CWE-306: Missing Authentication for Critical Function" and has an estimated C…
-
High 7.7
Brickcom Cameras Missing Authentication for Critical Function
Brickcom cameras allow unauthenticated access to live snapshot images via the /ONVIF endpoint and no authentication is required to retrieve still images from the camera feed.
-
High 8.8
Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, the Fission storagesvc component registers archive CRUD handlers (/v1/archive GET / POST / D…
-
High 8.3
Roxy-WI: Authentication bypass via 'api' substring in URL + unauthenticated /api/gpt
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, there is an authentication bypass vulnerability via 'api' substring in URL + unauthenticated /api/gpt. At time of publication, there are no p…
-
High 7.1
Missing authentication in Aix-DB
A missing authentication check on the Aix‑DB "/llm/process_llm_out" endpoint allows unauthenticated clients to execute arbitrary "SELECT" SQL queries and retrieve database data, as the endpoint lacks the token validation enforced on all other application endp…
-
High 7.8
During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Mana…
-
High 7.8
Microsoft PC Manager Elevation of Privilege Vulnerability
Missing authentication for critical function in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.
-
High 7.5
WordPress Augmented-Reality Plugin Remote Code Execution Unauthenticated
WordPress Augmented-Reality plugin contains a remote code execution vulnerability in the elFinder connector that allows unauthenticated attackers to upload and execute arbitrary PHP files. Attackers can send POST requests to the connector.minimal.php endpoint…
-
High 8.2
TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection
TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` …
-
High 8.8
Account Creation Exhaustion
The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems to flood the database.
-
High 8.1
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions without authenticatio…
-
High 7.3
nextlevelbuilder GoClaw Webhook Verification auth.go resolveAuth missing authentication
A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote…
-
High 7.1CVE-2026-24090 Public exploit
Missing Authentication for Critical Function in HLOS
Cryptographic issue while processing partition table entries allows unauthorized modification of boot flow.
-
High 8.2CVE-2026-24088 Public exploit
Missing Authentication for Critical Function in Boot
Cryptographic Issue while processing a specific partition which allows unauthorized write access to load a customized bootloader.
-
High 7.3
Enderfga claw-orchestrator API Endpoint embedded-server.ts EmbeddedServer missing authentication
A weakness has been identified in Enderfga claw-orchestrator up to 3.5.5. This affects the function EmbeddedServer of the file src/embedded-server.ts of the component API Endpoint. This manipulation causes missing authentication. The attack may be initiated r…
-
High 7.3CVE-2026-10243 Public exploit
code-projects Smart Parking System Admin Endpoint missing authentication
A security vulnerability has been detected in code-projects Smart Parking System 1.0. Affected is an unknown function of the component Admin Endpoint. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit…
-
High 8.8
Fourth Frontier Frontier X Mobile Application, Frontier X2 Missing Authentication for Critical Function
The Frontier X2 device allows unauthenticated BLE read/write access to critical GATT characteristics without enforcing pairing authentication or authorization. This allows attackers within BLE range to perform unauthorized control of device functions, includi…
-
High 8.7
Predator Connect W6x: unauthenticated Debug Service
Unauthenticated Debug Service. The /sbin/mtk_dut binary is exposed on TCP port 9000 without authentication, allowing any LAN-based attacker to execute arbitrary UCC commands.
-
High 8.8
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Self Service Manager). Supported ver…
-
High 8.8
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported vers…
-
High 8.8
RustFS: Authentication bypass in /profile/cpu and /profile/memory allows unauthenticated access to profiling handlers
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the admin router explicitly whitelists /profile/cpu and /profile/memory from the authentication layer, allowing any unauthenticated HTTP client to invoke profiling handlers wi…
-
High 7.5
Automad Broken Access Control: unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint
Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a sing…
-
High 7.5
Dalfox: Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in Dalfox Server Mode
Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request bo…
-
High 8.2
Dalfox: Unauthenticated Arbitrary File Create/Append via `output` Option in Dalfox Server Mode
Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the output, output-all, and debug fields in model.Options are JSON-tagged and deserialized directly from the attacker'…
-
High 7.4
FileRise: TOTP Bypass via Setup Endpoint Disclosing Existing Secret
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.12.0, /api/totp_setup.php is callable from a session that has only passed the password check (state pending_login_user). When the target account…
-
High 7.3
free5GC: NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-callback route group without inbound OAuth2/bearer-token authorization. A forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-to…