cve.bz

CWE-306: Missing Authentication for Critical Functionality, page 13

Filter

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

What the weakness is: CWE-306 at MITRE

Ask an AI about CWE-306

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-306: Missing Authentication for Critical Functionality and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/306.html and https://cve.bz/cve/cwe/306?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.4CVE-2026-88285EPSS 0.5%

    GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and issue PTZ or raw serial commands.

  2. 9.1CVE-2026-67593EPSS 0.9%

    A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. This issue affects Ap…

  3. 9.8CVE-2026-57967EPSS 1.5%

    An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 throu…

  4. 9.1CVE-2026-49364EPSS 0.6%

    An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache Activ…

  5. 7.5CVE-2026-49363EPSS 0.8%

    An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to authentication. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apach…

  6. 7.5CVE-2026-49362EPSS 0.8%

    An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0…

  7. 5.5CVE-2026-87924EPSS 0.8%

    A security vulnerability has been detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This affects an unknown part of the file includes/invoice_bill.php of the component Invoice Generation. Such…

  8. 5.5CVE-2026-87922EPSS 0.7%

    A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function DBOperation.addCategory of the file includes/process.php of the comp…

  9. 8.5CVE-2026-77974EPSS 0.3%

    After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through an unauthenticated and unsigned update channel.

  10. 5.3CVE-2026-79961EPSS 0.4%

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could pote…

  11. 4.3CVE-2026-11838EPSS 0.3%

    Missing authentication for critical function vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Reservation System allows Input Data Manipulation. This issue affects…

  12. 6.7CVE-2026-85981EPSS 0.2%

    The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access…

  13. 5.5CVE-2026-86808EPSS 0.8%

    A security vulnerability has been detected in moltis-org moltis up to 20260818.10. The affected element is the function vault_unlock_handler/vault_recovery_handler of the file vault.rs. Such manipulation leads to missing authentication. Th…

  14. 9.9CVE-2026-86464EPSS 0.5%

    In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deployment included insecure default configurations and credentials for security-sensitive services. …

  15. 5.5CVE-2026-83991EPSS 0.3%

    Missing authentication for critical function in Windows Cloud Files Mini Filter Driver allows an authorized attacker to perform tampering locally.

  16. 5.5CVE-2026-73004EPSS 0.3%

    Missing authentication for critical function in Windows Autopilot allows an authorized attacker to perform tampering locally.

  17. 5.5CVE-2026-72964EPSS 0.3%

    Missing authentication for critical function in Windows Internet Connection Sharing (ICS) allows an authorized attacker to perform tampering locally.

  18. 5.5CVE-2026-69674EPSS 0.3%

    Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to bypass a security feature locally.

  19. 5.5CVE-2026-69554EPSS 0.3%

    Missing authentication for critical function in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally.

  20. 7.8CVE-2026-69528EPSS 0.3%

    Missing authentication for critical function in Windows Shell allows an authorized attacker to elevate privileges locally.

  21. 6.8CVE-2026-69415EPSS 0.7%

    Missing authentication for critical function in Windows DHCP Server allows an authorized attacker to elevate privileges over a network.

  22. 5.5CVE-2026-69321EPSS 0.3%

    Missing authentication for critical function in Windows Power Dependency Coordinator allows an authorized attacker to perform tampering locally.

  23. 8.7CVE-2026-86728EPSS 0.6%

    AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user …

  24. 8.7CVE-2026-86727EPSS 0.5%

    AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can …

  25. 8.8CVE-2026-77097EPSS 0.5%

    Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.

  26. 9.3CVE-2026-62645EPSS 0.6%

    A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is exposed through the web interface that can be used to calculate the current and past session ID numbers. This could allow an attacker to bypass the…

  27. 7.7CVE-2026-19397EPSS 0.3%

    Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to the agent when the host has an active login session. Refer to the '  S…

  28. 9.3CVE-2026-86543EPSS 0.9%

    knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to pr…

  29. 5.9CVE-2026-86506EPSS 0.4%

    In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling data

  30. 8.4CVE-2026-86502EPSS 0.2%

    In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts

  31. 3.7CVE-2026-86486EPSS 0.3%

    In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank

  32. 9.8CVE-2026-86480EPSS 0.6%

    In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges

  33. 8.2CVE-2026-79645EPSS 0.4%

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could pote…

  34. 7.5CVE-2026-78480EPSS 0.6%

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could pote…

  35. 8.1CVE-2026-80132EPSS 0.5%

    ell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could poten…

  36. 9.8CVE-2026-76578EPSS 1.2%

    A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a rel…

  37. 5.5CVE-2026-86293EPSS 0.8%

    A flaw has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this vulnerability is an unknown functionality of the file delete-user.php of the component Deletion Endpoint. Executing a manipulation of the argument …

  38. 5.5CVE-2026-86292EPSS 0.7%

    A vulnerability was detected in SourceCodester Simple Traffic Offense System 1.0. Affected is an unknown function of the file saveuser.php of the component User Creation. Performing a manipulation of the argument position results in missin…

  39. 9.3CVE-2026-16876EPSS 0.6%

    An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V. A user could bypass authentication and execute arbitrary CLI commands by tampering with WebGUI messages and sending them to the device via internet.

  40. 9.0CVE-2026-86259EPSS 0.4%

    OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url head…

  41. 8.1CVE-2026-86242ExploitEPSS 3.6%

    Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default, governance.auth_config.is_enabled=false). The…

  42. 8.8CVE-2026-67277KEVEPSS 1.6%

    RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an …

  43. 9.3CVE-2026-86184EPSS 1.1%

    Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APP_ENV is not production. Attackers can request the …

  44. 9.3CVE-2026-86124EPSS 1.0%

    AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the exposed communication port and execute a…

  45. 9.3CVE-2026-86121EPSS 1.1%

    Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can rea…

  46. 5.5CVE-2026-85702EPSS 0.7%

    A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected is the function _conversation of the file server/backend.py of the component Backend Conversation API. Such m…

  47. 5.5CVE-2026-85701EPSS 0.6%

    A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.create of the file g4f/__init__.py of the component Authentication Check. Such mani…

  48. 9.8CVE-2026-79391EPSS 0.7%

    No authentication exists in the MQTT service of Trueview 6.0.23.4. The MQTT broker accepts client connections on TCP port 1883 without requiring authentication, allowing a remote attacker with network access to establish an MQTT session an…

  49. 5.5CVE-2026-85637EPSS 0.7%

    A security flaw has been discovered in jofpin trape 1.0.0/2.0. Affected by this issue is the function join_room of the file core/sockets.py of the component Admin Endpoint. The manipulation results in missing authentication. The attack may…

  50. 9.2CVE-2026-9317EPSS 1.3%

    Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers…