CWE-306 Missing Authentication for Critical Function
baseThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (4423)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-67277US | high8.2OT critical | KEV | ||
RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 U… | ||||
| CVE-2026-81578US | critical9.8OT critical | KEV | ||
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting… | ||||
| CVE-2026-72529US | —OT critical | KEV | ||
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an ar… | ||||
| CVE-2026-56164US | critical9.8OT critical | KEV | ||
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-59822US | high8.2OT critical | KEV | ||
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to… | ||||
| CVE-2026-35273US | —OT critical | KEV | ||
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8… | ||||
| CVE-2026-20253US | —OT critical | KEV | ||
In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service… | ||||
| CVE-2026-46817US | —OT critical | KEV | ||
Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable… | ||||
| CVE-2026-41940US | —OT critical | KEV | ||
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the… | ||||
| CVE-2026-39987US | critical9.8OT critical | KEV | ||
marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowi… | ||||
| CVE-2026-33017US | critical9.8OT critical | KEV | ||
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building… | ||||
| CVE-2026-1603US | high7.5OT critical | KEV | ||
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data. | ||||
| CVE-2026-24423US | critical9.8OT critical | KEV | ||
SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the Sm… | ||||
| CVE-2025-48572US | —OT critical | KEV | ||
In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of privilege with no additi… | ||||
| CVE-2025-61757US | —OT critical | KEV | ||
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easil… | ||||
| CVE-2025-4008US | high8.8OT critical | KEV | ||
The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written i… | ||||
| CVE-2025-34028US | critical10.0OT critical | KEV | ||
The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vu… | ||||
| CVE-2025-32433US | —OT critical | KEV | ||
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform… | ||||
| CVE-2025-3248US | critical9.8OT critical | KEV | ||
Langflow versions prior to 1.3.0 are susceptible to code injection in
the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to e… | ||||
| CVE-2025-0108US | critical9.1OT critical | KEV | ||
An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authenticat… | ||||
04
attack patterns (5)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan