cve.bz

CWE-306: Missing Authentication for Critical Functionality, page 30

Filter

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

What the weakness is: CWE-306 at MITRE

Related attack patterns (CAPEC): 5
  • CAPEC-12 Choosing Message Identifier Likelihood: High · Severity: High
  • CAPEC-36 Using Unpublished Interfaces or Functionality Likelihood: Medium · Severity: High
  • CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
  • CAPEC-166 Force the System to Reset Values Severity: Medium
  • CAPEC-216 Communication Channel Manipulation

The attack patterns MITRE's CAPEC relates to CWE-306, as MITRE names them. Credits.

Ask an AI about CWE-306

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-306: Missing Authentication for Critical Functionality and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/306.html and https://cve.bz/cve/cwe/306?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2026-50512EPSS 0.3%

    Missing authentication for critical function in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.

  2. 5.6CVE-2026-9212EPSS 0.3%

    Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations.

  3. 6.8CVE-2026-50507EPSS 5.0%

    Missing authentication for critical function in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

  4. 9.6CVE-2026-47281EPSS 0.8%

    Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

  5. 9.3CVE-2023-54352EPSS 0.6%

    WordPress Seotheme contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by uploading malicious files to the theme directory. Attackers can access the uploaded PHP shell at /wp-c…

  6. 8.7CVE-2023-54350EPSS 0.5%

    WordPress Augmented-Reality plugin contains a remote code execution vulnerability in the elFinder connector that allows unauthenticated attackers to upload and execute arbitrary PHP files. Attackers can send POST requests to the connector.…

  7. 10.0CVE-2026-11429EPSS 1.1%

    Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user-supplied filename component is used to construct the destination path without validation, allowing ar…

  8. 10.0CVE-2026-11420EPSS 0.7%

    Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauthenticated network attacker to write arbitrary files to any writable location on the server filesystem and to read packa…

  9. 8.2CVE-2026-45327EPSS 0.4%

    TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic aut…

  10. 9.3CVE-2025-71318EPSS 0.5%

    NetMan 204 fails to enforce authentication on its administrative pages and command endpoints. A remote, unauthenticated attacker can directly request administrative pages (such as administration.html, administration-commands.html, and conf…

  11. 9.8CVE-2026-6274EPSS 0.5%

    Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerability in DTS Electronics Industry and Trade Ltd. Co. Redline WR3200 allows Accessing Functionality Not Properly Constrained by ACLs. This i…

  12. 5.9CVE-2026-11238EPSS 0.2%

    Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome…

  13. 7.2CVE-2024-27892EPSS 0.3%

    Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.

  14. 7.2CVE-2024-27890EPSS 4.4%

    Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.

  15. 9.3CVE-2026-25550EPSS 0.9%

    Seagull Software BarTender 2010, 2016, and 2019 contain an unauthenticated remote code execution vulnerability in the .NET Remoting service exposed on TCP port 7375 via BtSystem.Service.exe. The service registers an unauthenticated singlet…

  16. 9.3CVE-2019-25738EPSS 0.3%

    WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify WordPress options by exploiting the hc_ajax_save_option action. Attackers can send POST requests to t…

  17. 8.8CVE-2026-50225EPSS 0.2%

    The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems to flood the database.

  18. 8.1CVE-2026-36603EPSS 0.2%

    Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions without authentication on port 1900, including AddPortMapping and GetExternalIPAddress. UPnP is enabled by default through the admin interfac…

  19. 5.5CVE-2026-10617EPSS 0.4%

    A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing au…

  20. 9.3CVE-2026-42074EPSS 0.6%

    OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the dangerouslyDisableSandbox parameter is exposed as part of the BashTool input schema, meaning the LLM (an untr…

  21. 9.2CVE-2026-0611EPSS 0.7%

    Spacelabs Healthcare Sentinel versions 10.5.x and higher and 11.x.x before 11.6.0 contain an unauthenticated remote code execution vulnerability through a deprecated .NET Remoting HTTP channel exposed on port 8989 that allows attackers to …

  22. 7.1CVE-2026-24090EPSS 0.06%

    Cryptographic issue while processing partition table entries allows unauthorized modification of boot flow.

  23. 8.2CVE-2026-24088EPSS 0.09%

    Cryptographic Issue while processing a specific partition which allows unauthorized write access to load a customized bootloader.

  24. 5.3CVE-2026-10283EPSS 0.3%

    A vulnerability was detected in Bottelet DaybydayCRM up to 2.2.1. Affected is an unknown function of the component Setting Handler. Performing a manipulation results in missing authentication. Remote exploitation of the attack is possible.…

  25. 5.5CVE-2026-10281EPSS 0.4%

    A weakness has been identified in Enderfga claw-orchestrator up to 3.5.5. This affects the function EmbeddedServer of the file src/embedded-server.ts of the component API Endpoint. This manipulation causes missing authentication. The attac…

  26. 9.6CVE-2026-44211EPSS 0.2%

    Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At time of publication, there are no publicly ava…

  27. 6.3CVE-2026-25599EPSS 0.1%

    Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump’s we…

  28. 5.5CVE-2026-10243EPSS 0.6%

    A security vulnerability has been detected in code-projects Smart Parking System 1.0. Affected is an unknown function of the component Admin Endpoint. Such manipulation leads to missing authentication. It is possible to launch the attack r…

  29. 9.3CVE-2018-25412EPSS 0.8%

    Delta Sql 1.8.2 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to docs_upload.php with crafted multipart form data. Attackers can upload PHP files wi…

  30. 9.3CVE-2026-9051EPSS 0.6%

    There is an authentication bypass vulnerability in the NI SystemLink Enterprise Dashboard application that may allow an unauthenticated remote attacker to bypass authentication controls leading to privilege escalation or information disclo…

  31. 9.8CVE-2026-44649EPSS 0.2%

    SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern accepts Remote-User (Authel…

  32. 8.8CVE-2026-5768EPSS 0.3%

    The Frontier X2 device allows unauthenticated BLE read/write access to critical GATT characteristics without enforcing pairing authentication or authorization. This allows attackers within BLE range to perform unauthorized control of devic…

  33. 6.9CVE-2026-45577EPSS 0.2%

    Neotoma provides versioned records that persist across agent runs. From 0.6.0 to before 0.11.1, Neotoma can treat public reverse-proxied requests as local when the app receives them over a loopback socket and no Bearer token is present. In…

  34. 6.5CVE-2026-45610EPSS 0.1%

    WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a cross-site request forgery vulnerability on the 2FA toggle. plugin/LoginControl/set.json.php accepts POST type=set2FA value=false, calls LoginControl::setUser2FA…

  35. 8.7CVE-2026-49195EPSS 0.2%

    Unauthenticated Debug Service. The /sbin/mtk_dut binary is exposed on TCP port 9000 without authentication, allowing any LAN-based attacker to execute arbitrary UCC commands.

  36. 9.8CVE-2026-8732ExploitEPSS 20%

    The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_…

  37. 10.0CVE-2026-46840EPSS 0.7%

    Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compro…

  38. 8.8CVE-2026-46827EPSS 0.2%

    Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Self Service Manager). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…

  39. 8.8CVE-2026-46826EPSS 0.3%

    Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network…

  40. 9.9CVE-2026-46824EPSS 0.3%

    Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low…

  41. 9.8CVE-2026-46817KEVEPSS 12%

    Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network…

  42. 6.9CVE-2026-47136EPSS 0.3%

    RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the RustFS console endpoint GET /rustfs/console/license returns parsed license metadata without requiring authentication. The endpoint is registered on the…

  43. 6.0CVE-2026-46685EPSS 0.1%

    RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, when RUSTFS_CORS_ALLOWED_ORIGINS is unset, the RustFS S3 listener's ConditionalCorsLayer reflects any request Origin value back as Access-Control-Allow-Ori…

  44. 7.5CVE-2026-45332ExploitEPSS 1.4%

    Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator…

  45. 8.8CVE-2026-45044EPSS 0.3%

    RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the admin router explicitly whitelists /profile/cpu and /profile/memory from the authentication layer, allowing any unauthenticated HTTP client to invoke p…

  46. 8.7CVE-2026-8697EPSS 0.5%

    Due to improper enforcement of authentication rate-limiting on a debug SSH service in Archer C64 v1, the SSH service allows unlimited authentication attempts and uses the same credentials as the web interface. This enables an attacker to …

  47. 9.8CVE-2026-45083EPSS 0.4%

    The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From 4.8.0 to before 26.04.1, the Goobi viewer REST endpoint POST /api/v1/index/stream accepted an arbitrary Solr streaming expression f…

  48. 9.8CVE-2026-8364EPSS 0.4%

    Gladinet Triofox Cloud Server Agent Access Service (GladServerAgentService.exe) listens on TCP port 7878 and processes remote HTTP messages with URL paths starting with /resources, /status, /sysinfo, /woshome, /Settings, /schedule, or /Dav…

  49. 8.2CVE-2026-45089EPSS 0.2%

    Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the output, output-all, and debug fields in model.Options are JSON-tagged and deserialized directl…

  50. 7.5CVE-2026-45088EPSS 0.3%

    Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the a…