CWE-306: Missing Authentication vulnerabilities

Swann Communications SWIFI-SE2KIC devices running firmware version 2.0.22 and earlier have a vulnerability where critical functions lack authentication. This flaw allows an attacker on the local network to access real-time video streams without any authentication. The vulnerability is identified as CWE-306 (Missing Authentication for Critical Function) and has a medium severity with a CVSS score of 6.9. No official patch or remediation has been provided in the available data.

Swann Communications SWIFI-SE2KIC devices running firmware version 2.0.22 and earlier have a vulnerability where critical functions lack authentication. This flaw allows an attacker on the local network to retrieve a live feed snapshot without needing to authenticate. The vulnerability is identified as CWE-306 (Missing Authentication for Critical Function) and has a CVSS 4.0 score of 6.9, indicating medium severity.

SWIFI-SE2KIC devices running firmware version 2.0.22 and earlier have a vulnerability where critical functions lack proper authentication. This flaw allows an attacker on the local network to access the live video feed without needing to authenticate. The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function) and has a medium severity rating with a CVSS 4.0 score of 5.9.

RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin *, and --rc-serve. A malicious web page opened by a user while the daemon is running can therefore send cross-origin requests to the unauthenticated local API with the user's operating-system privileges. The requests can disclose configured storage credentials and potentially access, upload, modify, or exfiltrate locally stored files accessible to the user and files available through configured remotes; the advisory's possible command-execution impact remains unconfirmed. This issue is fixed in version 0.2.7.

CVE-2026-106043 is a vulnerability in Ivanti Xtraction before version 2026.4 where a critical function lacks proper authentication. This flaw allows a remote unauthenticated attacker to create or modify trusted sites within the application. The vulnerability has a high severity score of 7.5 and impacts the integrity of the system without affecting confidentiality or availability.

CVE-2026-69227 is a critical vulnerability in Esri Portal for ArcGIS that allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This missing authentication flaw could enable attackers to perform administrative functions without proper credentials, potentially leading to full compromise of the portal. The vulnerability affects versions from 11.1 through 12.1 inclusive. It has a CVSS 3.1 base score of 9.8, indicating a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

CVE-2026-77096 is a high-severity vulnerability in Commvault Cloud's CVFS component caused by missing authentication for a critical function, allowing unauthorized command execution. The issue affects multiple versions prior to specific maintenance releases. Customers are advised to upgrade to the resolved maintenance releases to mitigate the risk.

NVIDIA NVSentinel for Linux contains a vulnerability in the platform-connectors component, where the gRPC health-event interface, exposed over a world-writable Unix domain socket, lacks authentication. A successful exploit of this vulnerability might lead to denial of service.

NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted token-revocation lists. A successful exploit may lead to data tampering and denial of service.

JTL SW GmbH JTL-WMS contains an authentication bypass vulnerability in its WMS MobileServer authorization middleware. The middleware fails to require authentication for HTTP methods other than GET and HEAD, and also allows requests with malformed or non-bearer Authorization headers to bypass token validation. This allows remote attackers with network access to invoke API functions without valid credentials. The vulnerability affects versions prior to 2.0.7, 2.1.2, and 2.2.1. The CVSS 4.0 score is 10.0, indicating critical severity.

The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the update_credential (PUT) and delete_credentials (DELETE) handlers for /api/v1/credentials, which omit the authentication call entirely. Because these handlers call directly into lib/msf/core/db_manager/cred.rb, which performs no authorization check of its own, any client able to reach the web service on its default 0.0.0.0:8080 listener can read, modify, or permanently delete every stored credential record — including passwords, hashes, and private keys stored for a shared team engagement — without presenting any authentication. All published versions of Metasploit Framework through 6.5.4 are affected. The issue is fixed in 6.5.5 by adding warden.authenticate! as the first statement in both handlers, matching the pattern used by every other route in the API.

0xJacky nginx-ui versions prior to 2.4.1 contain an improper authentication vulnerability (CWE-287) in the two-factor authentication enrollment endpoints. The endpoints for enrolling TOTP and WebAuthn passkeys require only a valid JWT and are not protected by a secure session middleware, allowing an attacker with a stolen JWT to bind their own second factor to a victim's account without re-authentication. This enables persistent account takeover that survives password resets and locks out legitimate users.

CVE-2026-109575 is a critical authentication bypass vulnerability in HAProxy Data Plane API Enterprise Edition versions 2.2.0 through 3.4.3. The flaw arises from a process-global authentication logic error that disables Basic authentication on shared internal request handlers when TLS CA and numeric TLS port are configured. This causes non-mutual TLS listeners such as HTTP and UNIX domain socket endpoints to fail open, allowing unauthenticated attackers to gain full administrative API access. Exploitation enables reading or replacing HAProxy configuration data without credentials. The issue is fixed in versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, and corresponding Enterprise Edition backports.

CVE-2026-57118 is a critical vulnerability in MervinPraison's PraisonAI multi-agent teams system. Versions prior to 1.6.59 allow unauthenticated remote clients to access critical functions such as listing agents and invoking agent chat endpoints without authentication. This lack of access control enables attackers to enumerate agents, consume model resources, access private context, and trigger agent tools or workflows. The issue is fixed in version 1.6.59.

CVE-2026-92681 is a critical vulnerability in @neo4j/graphql versions from 3.23.0 up to 7.6.3. It involves missing authentication enforcement for top-level fields annotated with @cypher when @authentication directives are applied at the schema or type level. This flaw allows unauthenticated users to invoke these fields and execute Cypher statements with the privileges of the GraphQL service account, potentially leading to unauthorized data reading and modification. The issue is fixed in version 7.6.4.

In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.

CVE-2026-108263 is a critical vulnerability in iflytek's astron-agent prior to version 1.1.2. It involves improper neutralization of directives in dynamically evaluated code, allowing an authenticated low-privilege tenant to execute arbitrary code as root within the core-workflow container. This can lead to unauthorized access to shared service and database credentials, bypassing tenant isolation, and enabling data compromise or service disruption. The issue is fixed in version 1.1.2.

x64dbg-MCP Server versions prior to 1.1 expose the debugger's full functionality over HTTP without any authentication, allowing unauthenticated network clients to execute arbitrary debugger commands, attach to processes, and manipulate memory and files. This critical vulnerability is fixed in version 1.1.

CVE-2026-33367 is a high-severity vulnerability in Red Lion Controls 700 Series devices where SNMP allows unauthenticated administrative actions. This includes retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades without any authentication.

CVE-2026-85479 is a medium severity vulnerability in the Grid Protection Alliance openPDC product. The STTP-based data publisher component accepts network connections without requiring authentication by default. This allows an unauthenticated attacker on the network to connect and exchange data with the interface.