CWE-306— Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.— MITRE CWE catalog
3,507 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-306page 47 of 71
- CVE-2025-25068HIGHCVSS 7.5EG 7.52025-03-21
Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to enforce MFA on plugin endpoints, which allows authenticated attackers to bypass MFA protections via API requests to plugin-specific routes.
- CVE-2024-6842HIGHCVSS 7.5EG 7.52025-03-20
In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings. The data returned by the `currentSettings` function includes sensitive information such as AP…
- CVE-2024-50630HIGHCVSS 7.5EG 7.52025-03-19
Missing authentication for critical function vulnerability in the webapi component in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102 allows remote attackers to obtain administrator credentials via unspec…
- CVE-2025-30111HIGHCVSS 7.5EG 7.52025-03-18
On IROAD v9 devices, one can Remotely Dump Video Footage and the Live Video Stream. The dashcam exposes endpoints that allow unauthorized users, who gained access through other means, to list and download recorded videos, as well as access…
- CVE-2025-25224HIGHCVSS 7.5EG 7.52025-02-18
The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a missing authentication vulnerability in dloader.php. If this vulnerability is exploited, arbitrary files on a server may be obtained.
- CVE-2025-26366HIGHCVSS 7.5EG 7.52025-02-12
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to disable front panel authentication via crafted HTTP…
- CVE-2025-26365HIGHCVSS 7.5EG 7.52025-02-12
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enable front panel authentication via crafted HTTP …
- CVE-2025-26364HIGHCVSS 7.5EG 7.52025-02-12
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to disable an authentication profile server via crafte…
- CVE-2025-26363HIGHCVSS 7.5EG 7.52025-02-12
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enable an authentication profile server via crafted…
- CVE-2025-26362HIGHCVSS 7.5EG 7.52025-02-12
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to set an arbitrary authentication profile server via …
- CVE-2025-0355HIGHCVSS 7.5EG 7.52025-01-15
Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and earlier, GB1200PE Ver.1.3.0 and earlier, WG2600HP4 Ver.1.4.2 and e…
- CVE-2024-13186HIGHCVSS 7.5EG 7.52025-01-08
The MinigameCenter module has insufficient restrictions on loading URLs, which may lead to some information leakage.
- CVE-2024-13185HIGHCVSS 7.5EG 7.52025-01-08
The MinigameCenter module has insufficient restrictions on loading URLs, which may lead to some information leakage.
- CVE-2024-13173HIGHCVSS 7.5EG 7.52025-01-08
The health module has insufficient restrictions on loading URLs, which may lead to some information leakage.
- CVE-2025-21623HIGHCVSS 7.5EG 7.52025-01-07
ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 238, ClipBucket V5 allows unauthenticated attackers to change the template directory via a directory traversal, which results in a denial of service.
- CVE-2024-53623HIGHCVSS 7.5EG 7.52024-11-29
Incorrect access control in the component l_0_0.xml of TP-Link ARCHER-C7 v5 allows attackers to access sensitive information.
- CVE-2024-50589HIGHCVSS 7.5EG 7.52024-11-08
An unauthenticated attacker with access to the local network of the medical office can query an unprotected Fast Healthcare Interoperability Resources (FHIR) API to get access to sensitive electronic health records (EHR).
- CVE-2024-48953HIGHCVSS 7.5EG 7.52024-11-07
An issue was discovered in Logpoint before 7.5.0. Endpoints for creating, editing, or deleting third-party authentication modules lacked proper authorization checks. This allowed unauthenticated users to register their own authentication p…
- CVE-2024-48950HIGHCVSS 7.5EG 7.52024-11-07
An issue was discovered in Logpoint before 7.5.0. An endpoint used by Distributed Logpoint Setup was exposed, allowing unauthenticated attackers to bypass CSRF protections and authentication.
- CVE-2024-21272HIGHCVSS 7.5EG 7.52024-10-15
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.0.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access v…
- CVE-2024-5749HIGHCVSS 7.5EG 7.52024-10-15
Certain HP DesignJet products may be vulnerable to credential reflection which allow viewing SMTP server credentials.
- CVE-2024-45276HIGHCVSS 7.5EG 7.52024-10-15
An unauthenticated remote attacker can get read access to files in the "/tmp" directory due to missing authentication.
- CVE-2024-48791HIGHCVSS 7.5EG 7.52024-10-14
An issue in Plug n Play Camera com.starvedia.mCamView.zwave 5.5.1 allows a remote attacker to obtain sensitive information via the firmware update process
- CVE-2024-48777HIGHCVSS 7.5EG 7.52024-10-11
LEDVANCE com.ledvance.smartplus.eu 2.1.10 allows a remote attacker to obtain sensitive information via the firmware update process.
- CVE-2024-48776HIGHCVSS 7.5EG 7.52024-10-11
An issue in Shelly com.home.shelly 1.0.4 allows a remote attacker to obtain sensitive information via the firmware update process
- CVE-2024-48775HIGHCVSS 7.5EG 7.52024-10-11
An issue in Plug n Play Camera com.ezset.delaney 1.2.0 allows a remote attacker to obtain sensitive information via the firmware update process.
- CVE-2024-48774HIGHCVSS 7.5EG 7.52024-10-11
An issue in Fermax Asia Pacific Pte Ltd com.fermax.vida 2.4.6 allows a remote attacker to obtain sensitve information via the firmware update process.
- CVE-2024-48773HIGHCVSS 7.5EG 7.52024-10-11
An issue in WoFit v.7.2.3 allows a remote attacker to obtain sensitive information via the firmware update process
- CVE-2024-48771HIGHCVSS 7.5EG 7.52024-10-11
An issue in almando GmbH Almando Play APP (com.almando.play) 1.8.2 allows a remote attacker to obtain sensitive information via the firmware update process
- CVE-2024-48768HIGHCVSS 7.5EG 7.52024-10-11
An issue in almaodo GmbH appinventor.ai_google.almando_control 2.3.1 allows a remote attacker to obtain sensitive information via the firmware update process
- CVE-2024-8751HIGHCVSS 7.5EG 7.52024-09-12
A vulnerability allows a remote unauthenticated attacker to modify the prod uct’s IP address over the Sopas ET interface. This can lead to a Denial of Service attack.
- CVE-2024-45049HIGHCVSS 7.5EG 7.52024-08-27
Hydra is a Continuous Integration service for Nix based projects. It is possible to trigger evaluations in Hydra without any authentication. Depending on the size of evaluations, this can impact the availability of systems. The problem can…
- CVE-2024-35124HIGHCVSS 7.5EG 7.52024-08-13
A vulnerability in the combination of the OpenBMC's FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020.00 through FW1020.60 default password and session management allow an attacker to gain administrative access to the BM…
- CVE-2024-21183HIGHCVSS 7.5EG 7.52024-07-16
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with …
- CVE-2024-37767HIGHCVSS 7.5EG 7.52024-07-05
Insecure permissions in the component /api/admin/user of 14Finger v1.1 allows attackers to access all user information via a crafted GET request.
- CVE-2024-31916HIGHCVSS 7.5EG 7.52024-06-27
IBM OpenBMC FW1050.00 through FW1050.10 BMCWeb HTTPS server component could disclose sensitive URI content to an unauthorized actor that bypasses authentication channels. IBM X-ForceID: 290026.
- CVE-2024-37368HIGHCVSS 7.5EG 7.52024-06-14
A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE. The vulnerability allows a user from a remote system with FTView to send a packet to the customer’s server to view an HMI project. Due to the l…
- CVE-2024-1662HIGHCVSS 7.5EG 7.52024-06-05
Missing Authentication for Critical Function, Missing Authorization vulnerability in PORTY Smart Tech Technology Joint Stock Company PowerBank Application allows Retrieve Embedded Sensitive Data. This issue affects PowerBank Application: …
- CVE-2024-27942HIGHCVSS 7.5EG 7.52024-05-14
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow any unauthenticated client to disconnect any active user from the server. An attacker could use this vulnerability to prevent any u…
- CVE-2023-44413HIGHCVSS 7.5EG 7.52024-05-03
D-Link D-View shutdown_coreserver Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of D-Link D-View. Authentication is not …
- CVE-2024-1491HIGHCVSS 7.5EG 7.52024-04-18
The devices allow access to an unprotected endpoint that allows MPFS file system binary image upload without authentication. The MPFS2 file system module provides a light-weight read-only file system that can be stored in external EEPRO…
- CVE-2024-21007HIGHCVSS 7.5EG 7.52024-04-16
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with …
- CVE-2024-21006HIGHCVSS 7.5EG 7.52024-04-16
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with …
- CVE-2023-4857HIGHCVSS 7.5EG 7.52024-04-15
An authentication bypass vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute certain IPMI calls that could lead to exposure of limited system information.
- CVE-2023-51571HIGHCVSS 7.5EG 7.52024-04-01
Voltronic Power ViewPower Pro SocketService Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Voltronic Power ViewPower P…
- CVE-2022-48621HIGHCVSS 7.5EG 7.52024-02-18
Vulnerability of missing authentication for critical functions in the Wi-Fi module.Successful exploitation of this vulnerability may affect service confidentiality.
- CVE-2023-49115HIGHCVSS 7.5EG 7.52024-02-01
MachineSense devices use unauthenticated MQTT messaging to monitor devices and remote viewing of sensor data by users.
- CVE-2023-6942HIGHCVSS 7.5EG 7.52024-01-30
Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Version1(GOT1000) versions 1.325P and prior, GT Designer3 Version1(GOT2000) versions 1.320J and prior…
- CVE-2023-40393HIGHCVSS 7.5EG 7.52024-01-10
An authentication issue was addressed with improved state management. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. Photos in the Hidden Photos Album may be viewed without authentication.
- CVE-2023-46978HIGHCVSS 7.5EG 7.52023-10-31
TOTOLINK X6000R V9.4.0cu.852_B20230719 is vulnerable to Incorrect Access Control.Attackers can reset login password & WIFI passwords without authentication.
Map vulnerabilities like CWE-306 to your infrastructure
EchelonGraph correlates every CVE — across CWE-306 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →