CWE-306: Missing Authentication vulnerabilities

Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator that protects sibling routes (/search_student, /storage) in the same file. Because card_id values are sequential integers, the entire student database can be enumerated without authentication.

CVE-2026-25703 is a high-severity vulnerability in SUSE NeuVector versions up to and including 5.4.9. It involves missing authentication for the critical /network/graph API in the manager component, which can lead to potential information leakage through cached sensitive data.

The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura.

changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.check_token nor @validate_openapi_request.

CVE-2026-58071 is a high-severity vulnerability in Veeam Service Provider Console that allows an unauthenticated attacker to access the proxied appliance API with asPortal Administrator privileges during a brief window after an administrator session starts. This issue is due to missing authentication for a critical function (CWE-306). No patch or official remediation guidance is currently available.

Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.

Dell Display and Peripheral Manager (DDPM Mac) versions prior to 2.3.0.1005 have a vulnerability due to missing authentication for a critical function. This flaw allows a low privileged local attacker to potentially elevate their privileges. The vulnerability is identified as CWE-306 and has a high severity rating with a CVSS score of 7.8.

In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's before_request hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication (CWE-306). This is the same defect class previously fixed as CVE-2026-12046 (the sqleditor close/update_connection routes). A follow-up sweep, prompted by a report describing an incomplete fix for CVE-2026-12046, found further routes missing @pga_login_required: the Constraints blueprint's nodes and proplist (object listing) routes and its delete route (a state-mutating DELETE that removes table constraints); preferences.get_all_cli (GET, discloses all CLI-settable preference values); debugger.close (DELETE); and schema_diff.close (DELETE). An unauthenticated network client could therefore enumerate constraint metadata, delete table constraints, read preference values, and force-close debugger or schema-diff sessions belonging to other users, without ever authenticating. Fix adds the missing @pga_login_required decorator (and the corresponding import to the Constraints module) to each of these routes. The change is decorator-only; no behavioral changes to the underlying handlers. This issue affects pgAdmin 4 in SERVER mode: the Constraints and Debugger routes from 1.0, the Schema Diff close route from 4.18, and preferences.get_all_cli from 8.2, all before 9.17.

ANDRITZ HIPASE-250 contains an unauthenticated HTTP endpoint that allows remote attackers to change the server's logging level and target. This vulnerability can be exploited to suppress audit logging, potentially hiding malicious activity. No authentication is required to access this critical function. The vulnerability has a medium severity score of 5.3 and does not impact confidentiality or availability but affects integrity by allowing log tampering. No patch or official remediation information is currently available.

ANDRITZ HIPASE-250, in its default configuration, exposes a data and configuration endpoint without any authentication and with permissive CORS settings. This allows an unauthenticated attacker with network access to read live process values and server configuration. The vulnerability is identified as CWE-306 (Missing Authentication for Critical Function) and CWE-942 (Permissive Cross-domain Whitelist).

Toptech Systems RCU II+ and Multiload II+ devices have an unauthenticated network service exposing a debug interface that grants full root access to the embedded Linux system. This vulnerability arises from a Target Communications Framework (TCF) service running on a network-accessible port without authentication. An attacker can connect remotely to view and modify the filesystem, control processes, and alter network interfaces, enabling deep system compromise. The vulnerability is tracked as CVE-2026-12562 with a high severity CVSS score of 8.8. No patch or official remediation guidance is currently available.

CVE-2026-68502 is a critical vulnerability in the LazyOwn RedTeam/APT Framework prior to version 0.2.154. The issue arises from an unauthenticated Socket.IO input event handler in lazyc2.py that allows remote attackers to execute arbitrary commands on the C2 server without authentication. This vulnerability enables unauthenticated remote code execution via the LazyOwnShell command interface. The flaw is fixed in version 0.2.154.

OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OSNEXUS QuantaStor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of Kapacitor. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-30036.

Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerce Management Panel allows Authentication Bypass. This issue affects FTC E-Commerce Management Panel: before 1.0.2.

CVE-2026-44101 is a critical vulnerability in Phoenix Contact CHARX SEC-3150 devices where the CHARX OCPP Agent service lacks authentication for a critical function. This flaw allows unauthenticated remote attackers to reconfigure the backend connection, potentially causing denial-of-service conditions and disclosure of confidential data. The vulnerability affects versions from 1.0.0 up to but not including 1.9.1. A fix is available in version 1.9.1.

The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging point UIDs, Denial-of-Service and files tampering.

CVE-2026-44090 is a critical vulnerability in Phoenix Contact CHARX SEC-3150 devices where missing authentication on the MQTT broker allows unauthenticated remote attackers to access it. The MQTT broker is only protected by a firewall from external access, which may be bypassed. Exploitation can lead to full compromise of the device. The vulnerability affects versions from 1.0.0 up to but not including 1.9.1. A fix is available in version 1.9.1.

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier