Weakness (CWE)
CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability.
Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port.
In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate credential management need to be used throughout.
-
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
-
Architecture and Design
Where possible, avoid implementing custom, "grow-your-own" authentication routines and consider using authentication capabilities as provided by the surrounding framework, operating system, or environment. These capabilities may avoid common weaknesses that are unique to authentication; support automatic auditing and tracking; and make it easier to provide a clear separation between authentication tasks and authorization tasks.
In environments such as the World Wide Web, the line between authentication and authorization is sometimes blurred. If custom authentication routines are required instead of those provided by the server, then these routines must be applied to every single page, since these pages could be requested directly.
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator [REF-45].
-
Implementation, System Configuration, Operation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to require strong authentication for users who should be allowed to access the data [REF-1297] [REF-1298] [REF-1302].
Source: MITRE CWE-306
672 results · Clear filters · Feed
-
Medium 4.3
Improper Access Control in danswer-ai/danswer
In version 0.4.1 of danswer-ai/danswer, a vulnerability exists where a basic user can create credentials and link them to an existing connector. This issue arises because the system allows an unauthenticated attacker to sign up with a basic account and perfor…
-
Medium 5.3
IROAD Dash Cam X5/Dash Cam X6 API Endpoint missing authentication
A vulnerability, which was classified as critical, has been found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. Affected by this issue is some unknown functionality of the component API Endpoint. The manipulation leads to missing authentication. The at…
-
Medium 5.3
A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.8), SiPass integrated ACC…
-
Medium 5.3
Missing Authentication check in SAP NetWeaver Enterprise Portal (OBN component)
SAP NetWeaver Enterprise Portal OBN does not perform proper authentication check for a particular configuration setting. As result, a non-authenticated user can set it to an undesired value causing low impact on integrity. There is no impact on confidentialit…
-
Medium 5.3
The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a missing authent…
-
Medium 5.0
Server-Side Access Control Bypass vulnerability in WombatDialer before 25.02 could allow unauthorized users to potentia…
-
Medium 6.5CVE-2024-57725 Public exploit
An issue in the Arcadyan Livebox Fibra PRV3399B_B_LT allows a remote or local attacker to modify the GPON link value wi…
-
Medium 5.9
PAN-OS: Authentication Bypass in the Management Web Interface
An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certai…
KEV Feb 18, 2025 -
Medium 5.3
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/persistance/routes.lua in Q-Free MaxTime less th…
-
Medium 6.1
Unauthenticated File Upload in wandb/openui
wandb/openui latest commit c945bb859979659add5f490a874140ad17c56a5d contains a vulnerability where unauthenticated endpoints allow file uploads and downloads from an AWS S3 bucket. This can lead to multiple security issues including denial of service, stored …
-
Medium 4.3
IBM UrbanCode Deploy missing authentication
IBM DevOps Deploy 8.0 through 8.0.1.4, 8.1 through 8.1.0.0 and IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14 and 7.3 through 7.3.2 could allow an authenticated user to obtain sensitive information about other user…
-
Medium 5.5
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Medium 5.3
An information disclosure vulnerability exists in the testsave.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A…
-
Medium 6.3
MinigameCenter information leakage vulnerability
The MinigameCenter module has insufficient restrictions on loading URLs, which may lead to some information leakage.
-
Medium 6.3
MinigameCenter module information leakage vulnerability
The MinigameCenter module has insufficient restrictions on loading URLs, which may lead to some information leakage.
-
Medium 6.3
Health information leakage vulnerability
The health module has insufficient restrictions on loading URLs, which may lead to some information leakage.
-
Medium 4.0
Sensitive information disclosure due to missing authentication. The following products are affected: Acronis True Image…
-
Medium 5.7
Arbitrary Code execution via exposed JTAG port in Kioxia CM6, PM6, PM7
There exists an unauthenticated accessible JTAG port on the Kioxia PM6, PM7 and CM6 devices - On the Kioxia CM6, PM6 and PM7 disk drives it was discovered that the 2 main CPU cores of the SoC can be accessed via an open JTAG debug port that is exposed on the …
-
Medium 6.3
Sensitive information leakage vulnerability in wifi module
The wifi module exposes the interface and has improper permission control, leaking sensitive information about the device.
-
Medium 6.4
When using special mode to connect to enterprise wifi, certain options are not properly configured and attackers can pr…
-
Medium 5.3
Synapse unauthenticated writes to the media repository allow planting of problematic content
Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also b…
-
Medium 5.3
Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administra…
-
Medium 4.8
Framework Information Disclosure Vulnerability
Improper control of framework service permissions with possibility of some sensitive device information leakage.
-
Medium 5.3
Missing authentication for critical function vulnerability exists in Rakuten Turbo 5G firmware version V1.3.18 and earl…
-
Medium 5.9
PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or…
KEV Nov 18, 2024 -
Medium 5.4
WAGO: Docker Settings Manipulation in Multiple Devices
A low privileged remote attacker may modify the docker settings setup of the device, leading to a limited DoS.
-
Medium 5.3
Insyde IHISI function 0x49 can restore factory defaults for certain UEFI variables without further authentication by de…
-
Medium 4.3
Missing permission check in Jenkins Script Security Plugin
Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to ch…
-
Medium 5.2
A missing authentication for critical function vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager…
-
Medium 6.4
An issue was discovered in Logpoint before 7.5.0. SOAR uses a static JWT secret key to generate tokens that allow acces…
-
Medium 5.3
API key access in settings without reauthentication in OctoPrint
OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain a vulnerability that allows an attacker that has gained temporary control over an authenticated victim's OctoPrint browser sessio…
-
Medium 6.5
The LSC Smart Connect Indoor IP Camera V7.6.32 is vulnerable to an information disclosure issue where live camera foota…
-
Medium 5.3
Get Quote For Woocommerce – Request A Quote For Woocommerce <= 1.0.0 - Missing Authorization to Unauthenticated Quote PDF and CSV Download
The Get Quote For Woocommerce – Request A Quote For Woocommerce plugin for WordPress is vulnerable to unauthorized access of Quote data due to a missing capability check on the ct_tepfw_wp_loaded function in all versions up to, and including, 1.0.0. This make…
-
Medium 6.5
Incorrect access control in Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.…
-
Medium 5.3
Vilo 5 Mesh WiFi System <= 5.16.1.33 lacks authentication in the Boa webserver, which allows remote, unauthenticated at…
-
Medium 5.9
CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause exposure of private data wh…
-
Medium 6.5
Schneider Elektronik Series 700 prone to missing authentication for traffic capture function
An unauthenticated remote attacker may use the devices traffic capture without authentication to grab plaintext administrative credentials.
-
Medium 6.3
Advantech ADAM-5630 Missing Authentication for Critical Function
Advantech ADAM-5630 has built-in commands that can be executed without authenticating the user. These commands allow for restarting the operating system, rebooting the hardware, and stopping the execution. The commands can be sent to a simple HTTP request and…
-
Medium 5.5
Missing authentication for critical function vulnerability in proxy settings functionality in Synology Active Backup fo…
-
Medium 4.0
Missing authentication for critical function vulnerability in logout functionality in Synology Active Backup for Busine…