cve.bz

CWE-306: Missing Authentication for Critical Functionality, page 18

Filter

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

What the weakness is: CWE-306 at MITRE

Ask an AI about CWE-306

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-306: Missing Authentication for Critical Functionality and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/306.html and https://cve.bz/cve/cwe/306?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2026-61367EPSS 0.3%

    Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.

  2. 7.8CVE-2026-61365EPSS 0.3%

    Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.

  3. 7.8CVE-2026-61364EPSS 0.3%

    Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.

  4. 7.8CVE-2026-61356EPSS 0.3%

    Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.

  5. 9.4CVE-2026-50516EPSS 0.8%

    Incorrect authorization in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privileges over a network.

  6. 7.8CVE-2026-42976EPSS 0.3%

    Missing authentication for critical function in Windows RPC API allows an authorized attacker to elevate privileges locally.

  7. 9.8CVE-2026-72920EPSS 0.8%

    SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filer_signing.key is unset, allowing any client that can reach the fil…

  8. 6.9CVE-2026-72748EPSS 1.2%

    AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests without …

  9. 10.0CVE-2026-58115EPSS 1.0%

    A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed). Affected devices do not enforce authentication on the Node-RED HTTP interface, al…

  10. 7.5CVE-2026-72605EPSS 0.5%

    A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting…

  11. 5.4CVE-2026-72542EPSS 0.3%

    A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the workspace regardless of ownership. The job_metrics handlers accept…

  12. 6.5CVE-2026-72541EPSS 0.3%

    A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update_resource_type endpoint. The endpoint omits the administrator per…

  13. 8.6CVE-2026-72536EPSS 0.6%

    A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication an…

  14. 8.6CVE-2026-72535EPSS 0.6%

    A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no …

  15. 7.4CVE-2026-15563EPSS 0.7%

    A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.

  16. 7.7CVE-2026-18941EPSS 0.9%

    A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "no_auth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to fe…

  17. 8.0CVE-2026-15581EPSS 0.4%

    A flaw was found in the TrustyAI Service (TAS) deployment. This vulnerability allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. An attacker can exploit this to read, tamper with, or del…

  18. 8.8CVE-2025-15683EPSS 0.6%

    TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application dat…

  19. 9.2CVE-2025-15681EPSS 0.7%

    TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication bypass in its web server. After a user has previously authenticated to the device, an unauthenticated attacker can directly access protected functionality through the /index.asp endp…

  20. 7.5CVE-2026-72871EPSS 0.5%

    Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/api/providers/github/setup.ts trusts gh_init organizationId and userId values from…

  21. 7.5CVE-2026-72688EPSS 0.6%

    A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTER_KEY-signed…

  22. 9.8CVE-2026-72593EPSS 0.8%

    A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server…

  23. 7.5CVE-2026-72586EPSS 0.6%

    A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQ_QUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO…

  24. 9.8CVE-2026-72577EPSS 1.3%

    Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application …

  25. 7.5CVE-2026-55814EPSS 0.7%

    Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

  26. 9.6CVE-2026-46409EPSS 0.3%

    OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to `127.0.0.1:<random port>` (commonly 19141) without serve…

  27. 9.8CVE-2026-61808ExploitEPSS 2.5%

    LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read …

  28. 7.1CVE-2025-71409EPSS 0.3%

    Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading clearances and potential pilot confusion. This type of attack can be carried out re…

  29. 10.0CVE-2026-63508EPSS 0.8%

    Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network.

  30. 8.7CVE-2026-70559EPSS 0.5%

    Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session …

  31. 8.8CVE-2026-53984EPSS 0.7%

    Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's database_backup event handler that allows any unauthenticated network peer to wipe or repla…

  32. 8.7CVE-2026-53985EPSS 0.7%

    Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's service_control event handler that allows any unauthenticated network peer to forcibly terminate the ground-station process…

  33. 8.7CVE-2026-53977EPSS 1.0%

    OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is registered before the …

  34. 5.5CVE-2026-18990EPSS 0.7%

    A vulnerability was detected in letta-ai LettaBot 0.2.0. Impacted is an unknown function of the file src/api/server.ts of the component API Status Route. The manipulation results in missing authentication. The attack may be performed from …

  35. 9.6CVE-2026-71319EPSS 0.6%

    Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the c…

  36. 8.7CVE-2026-69111EPSS 1.1%

    Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. Attackers…

  37. 7.5CVE-2026-8446EPSS 0.5%

    IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) composer endpoint when mcp_composer_enabled=true (default) and projects are configured with auth_type=oauth .

  38. 7.5CVE-2026-48911EPSS 0.6%

    Insufficient Verification of Data Authenticity vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing authorization check in the external-login email binding flow allows unauthenticated attackers to ta…

  39. 9.8CVE-2026-71289EPSS 0.7%

    The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface (port 8089, e.g. ":8089/tcp") with cap_a…

  40. 9.8CVE-2026-71262EPSS 0.6%

    IoTSharp BlobStorageController.cs lacks the [Authorize] attribute applied to every other controller in the application (DevicesController, CustomersController, TenantsController, etc.), and no global authorization FallbackPolicy is configu…

  41. 7.5CVE-2026-61891EPSS 0.5%

    In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT /files/`) that convert a client-supplied URI directly to a filesystem path and str…

  42. 7.5CVE-2026-71241EPSS 0.5%

    Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator that protects sibling routes (/search_student, /storage) in the same file. Because …

  43. 8.8CVE-2026-60009EPSS 0.4%

    In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart `uri` field and…

  44. 7.3CVE-2026-25703ExploitEPSS 0.8%

    NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive information.

  45. 9.8CVE-2026-71214EPSS 0.5%

    The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied J…

  46. 5.3CVE-2026-71203EPSS 0.3%

    changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method ca…

  47. 9.3CVE-2026-70552EPSS 0.8%

    MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-enc…

  48. 6.9CVE-2026-18810EPSS 0.7%

    A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads to missing authentication. The attack may be performed from remote. The vendor w…

  49. 9.3CVE-2026-69703EPSS 0.6%

    Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ign…

  50. 9.8CVE-2026-63455EPSS 0.8%

    Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allo…