CWE-306: Missing Authentication vulnerabilities

FastGPT versions prior to 4.15.2 have a missing authorization vulnerability in the WeChat (iLink) share-channel endpoints. These endpoints rely solely on a public shareId for authorization, which is exposed in shared URLs and embeds, allowing unauthenticated attackers to hijack or disrupt victim teams' WeChat bots. Attackers can log out the victim's bot or bind the victim's app to their own bot, exposing private responses and consuming victim resources. This issue is fixed in version 4.15.2.

KubePi versions up to and including 1.6.15 have a missing authentication vulnerability in the SSO configuration API endpoints. These endpoints are accessible without administrator authorization, allowing unauthorized or low-privileged users to read, create, or update global SSO settings. This can lead to account takeover or privilege escalation. Additionally, the SSO connectivity-test function can be abused for server-side request forgery, and the user list API leaks authentication-related fields. The issue is fixed in version 2.0.0.

CVE-2026-47837 is a vulnerability in Spring Cloud Config where the /monitor endpoint does not validate webhook requests, resulting in missing authentication for a critical function. This affects multiple versions of Spring Cloud Config from 3.1.14 through 5.0.4. The vulnerability has a CVSS score of 6.8, indicating medium severity, and can cause availability impact. No official patch or remediation guidance is currently provided by the vendor.

CAYIN CMS-WS and CMS-SE products from CAYIN Technology have a missing authentication vulnerability that allows unauthenticated remote attackers to access media file lists. This results in partial information disclosure without requiring user interaction or privileges. The vulnerability is identified as CWE-306 and has a medium severity score of 5.3. No patch or official remediation has been confirmed yet.

NVIDIA NemoClaw for Linux has a vulnerability in its inference server setup that allows remote attackers to access the inference service without authentication. This can lead to unauthorized information disclosure and denial of service. The vulnerability is identified as CWE-306, indicating missing authentication for a critical function. The CVSS score is 8.1, reflecting high severity. No patch or official remediation has been confirmed yet. There are no known exploits in the wild at this time.

CVE-2026-55571 is an improper authorization vulnerability in djust prior to version 1.0.4. The issue occurs because the LiveViewConsumer.handle_mount method sends a navigation frame on authorization failure but does not close the WebSocket or clear the view instance. This allows raw WebSocket clients to bypass authentication checks and invoke event handler methods without a valid session, potentially leading to unauthorized sensitive reads or mutations. The vulnerability is fixed in version 1.0.4.

Nextcloud MCP Server versions prior to 0.117.2 have a missing authentication vulnerability on the POST /webhooks/nextcloud endpoint. The default configuration allows unauthenticated requests because the WEBHOOK_SECRET is unset by default and not validated at startup. This enables an attacker to send forged webhook payloads that specify arbitrary user IDs, leading to unauthorized deletion or re-indexing of vector embeddings and destruction of the semantic search index. The issue is fixed in version 0.117.2.

PraisonAI versions prior to 4.6.58 have an improper authentication vulnerability where the create_auth_middleware() function allows unauthenticated requests if the API key or JWT secret is missing. This enables an externally accessible Recipe server to accept unauthenticated POST requests to /v1/recipes/run despite authentication being enabled. The issue is resolved in version 4.6.58.

PraisonAI versions prior to 4.6.58 have a missing authentication vulnerability in the Jobs API create_app function. The API endpoint /api/v1/runs is accessible without authentication, allowing any caller to submit jobs, read results, cancel runs, or delete jobs using operator credentials. This issue is fixed in version 4.6.58 by adding middleware that enforces API key authorization.

CVE-2026-55538 is a vulnerability in MervinPraison's PraisonAI multi-agent system. Versions prior to 4.6.58 do not properly authenticate POST requests to /agents and /agents/{agent_name}, allowing requests with missing or incorrect bearer tokens and X-API-Key values to reach agent execution. This missing authentication for critical functions can lead to unauthorized access and potential impact on confidentiality, integrity, and availability. The issue is fixed in version 4.6.58.

PraisonAI versions from 4.6.34 up to but not including 4.6.58 have a missing authentication vulnerability in the _create_agents_app() function. Specifically, the server accepts an --api-key parameter, but does not authenticate POST requests to /agents or /agents/{agent_name}, allowing network callers to invoke configured agents without credentials. This issue is fixed in version 4.6.58.

PraisonAI versions prior to 1.6.58 have a missing authentication check on AgentServer routes, allowing remote callers to perform actions without valid tokens even when authentication is configured. This vulnerability is fixed in version 1.6.58.

CVE-2026-55529 is a vulnerability in MervinPraison's PraisonAI multi-agent teams system prior to version 4.6.58. The issue arises because the MCP HTTP Stream _validate_origin method incorrectly validates origins by using a startswith check, allowing attacker-controlled origins like localhost.evil.example to bypass the localhost allowlist. This enables a malicious webpage to submit requests to the local MCP server without an API key and execute exposed tools. The vulnerability is fixed in version 4.6.58.

Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileges.

CVE-2026-57909 is a critical path traversal vulnerability in WatchGuard Agent that allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary code on the affected system. The vulnerability is identified as CWE-306 and has a CVSS 4.0 base score of 9.4, indicating high impact and exploitability. No patch or official remediation has been confirmed yet. There are no known exploits in the wild at this time.

Firmware in KAON PG5298A and PG5298B routers contains a vulnerability that allows unauthenticated users to access a specific endpoint and retrieve sensitive information, including the administrative portal password. This security flaw is identified as CWE-306, indicating missing authentication for a critical function. The issue has been addressed in firmware versions 3.0.82 for PG5298A and 4.0.82 for PG5298B.

DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone's internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator's wireless control, video, and telemetry connections during flight. Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600. Remediation requires a firmware update from the vendor.

CVE-2026-78255 is a high-severity vulnerability affecting multiple DJI drone models. The HTTP media server on these drones exposes stored photos and videos through the /v2 endpoint without requiring authentication. Attackers on the drone's internal network can enumerate predictable filenames to access sensitive media, potentially revealing private locations, travel history, and identifiable individuals. The vulnerability affects various DJI models up to specific firmware versions.

CyberTutor's NewSiteServer (NSS) contains a missing authentication vulnerability that allows unauthenticated remote attackers to send emails on behalf of the school. This issue is classified under CWE-306 and has a medium severity rating with a CVSS score of 5.3. No affected versions or patches are specified in the available data.

CVE-2026-48106 is a high-severity vulnerability in Basekick-Labs' Arc, an open SQL-native time-series database. Versions prior to 26.06.1 have a missing authentication mechanism for the MsgReplicateSync payload in the cluster replication receiver, allowing application-layer message tampering or replay attacks despite transport-layer TLS/mTLS protection. The issue is fixed in version 26.06.1. Workarounds include restricting cluster network access, auditing replication logs, or disabling cluster mode until patched.