Home/CWE/Missing Authentication for Critical Function
Weakness

Missing Authentication for Critical Function

CWE-306 · Base · Draft

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

△

Weakness Relationships

Where this weakness sits in the CWE hierarchy. Walk up to broader classes or down to more specific variants.
Parent of this (broader)
ChildOfCWE-287 · Improper Authentication
Children (more specific)
ParentOfCWE-288 · Authentication Bypass Using an Alternate Path or Channel
ParentOfCWE-322 · Key Exchange without Entity Authentication
◆

Attack Patterns (CAPEC)

5
How adversaries exploit this weakness, per MITRE CAPEC.
CAPEC-12Choosing Message Identifier
CAPEC-166Force the System to Reset Values
CAPEC-216Communication Channel Manipulation
CAPEC-36Using Unpublished Interfaces or Functionality
CAPEC-62Cross Site Request Forgery
⚠

CVEs With This Weakness

2,600
A sample of the 2,600 CVEs tagged with this weakness.
CVECVE-2026-8737
CVECVE-2026-8185
CVECVE-2026-8031
CVECVE-2026-7844
CVECVE-2026-7723
CVECVE-2026-7714
CVECVE-2026-7415
CVECVE-2026-7113
CVECVE-2026-7042
CVECVE-2026-6736
CVECVE-2026-6588
CVECVE-2026-6582
◉

Nuclei Scanner Templates

30
Open-source Nuclei templates that detect this weakness class - an actionable scan-for-it pivot. Licensed under the ProjectDiscovery / Nuclei terms.
criticalPerforce Server - Passwordless User Accounts
criticalMarimo <= 0.20.4 - Pre-Auth Terminal WebSocket RCE
criticalDagu Workflow Engine - Remote Code Execution
criticalApache Hadoop YARN ResourceManager - Remote Code Execution
criticalUniFi Access - Broken Access Control
criticalOracle Identity Manager REST WebServices - Authentication Bypass
criticalLangflow AI - Unauthenticated Remote Code Execution
criticalMCP Inspector < 0.14.0 UnauthenticatedRemote Code Execution
criticalFlowise <= 3.0.5 - Account Takeover
criticalTriofox - Improper Access Control
criticalKubeView <=0.1.31 - Information Disclosure
criticalOpen Automation Software OAS Platform V16.00.0121 - Missing Authentication
criticalMitel MiCollab - Information Disclosure & Denial of Service
criticalApache ShenYu Admin Unauth Access
criticalOracle E-Business Suite 12.2.3 -12.2.11 - Remote Code Execution
criticalF5 BIG-IP iControl - REST Auth Bypass RCE
criticalMLflow Job API - Authentication Bypass
criticalLangflow - Broken Access Control
criticalMCPJam Inspector - Remote Code Execution
criticalSmarterMail - Remote Code Execution
criticalRclone RC - Broken Access Control
criticalGoogle ADK-Python - Unauthenticated Builder Endpoint
criticalLoLLMs WEBUI - Server-Side Request Forgery
criticalNginx UI < 2.3.3 - Information Disclosure
criticalNginx UI - Broken Access Control
criticalSAP Solution Manager 7.2 - Remote Command Execution
criticalWordpress Quiz and Survey Master <7.0.1 - Arbitrary File Deletion
criticalApache Spark - Authentication Bypass
criticalSAP NetWeaver AS JAVA 7.30-7.50 - Remote Admin Addition
criticalvBulletin SQL Injection
External lookups - second-class, for what we don’t hold ourselves
MITRE CWE
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin