CWE-306: Missing Authentication vulnerabilities

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts a caller-chosen application authorization identifier, applications/:id/confirm binds that identifier to a logged-in user through a generic consent page, and the public packages/server/src/routes/api/application_auth.ts endpoint passes it to ApplicationModel.createAppPassword without authenticating or binding the redeemer. An attacker can cause a victim to approve the attacker's identifier, redeem a durable application ID and password, and exchange the credential for a victim session with full read and write access to synchronized data. This vulnerability is fixed in 3.7.13.

CVE-2026-105105 is a critical vulnerability in NASA-AMMOS AIT-Core versions up to 3.1.1 where the ait.core.server telemetry and command broker (ait-server) lacks authentication for critical functions. This allows unauthenticated remote attackers with network access to the ZeroMQ message bus to inject spacecraft command data, exfiltrate command and telemetry traffic, inject forged telemetry, or disrupt the command and telemetry bus. The default configuration binds ZeroMQ sockets to all network interfaces without authentication or transport security. Version 3.1.2 mitigates this by changing the default ZeroMQ bind addresses to loopback only.

Zilliz Attu versions from 2.6.5 up to but not including 3.0.0 contain a vulnerability in the Playground feature that allows proxying arbitrary HTTP and HTTPS requests without requiring authentication. This missing authentication for a critical function could allow unauthorized users to misuse the proxy capability. The vulnerability has a medium severity with a CVSS score of 5.8.

CVE-2026-95102 is a critical vulnerability in Monta's monta.app where WebSocket endpoints lack proper authentication. This allows attackers to impersonate charging stations, potentially gaining unauthorized access to sensitive data and performing unauthorized actions. The absence of authentication can lead to privilege escalation and compromise the system's security.

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role policies attached to managed agent roles, via any request to the application API in a deployment where no identity provider is configured. To remediate this issue, users should upgrade to version 1.6.1 or later.

FilamentPHP versions from 4.0.0 up to but not including 4.13.3 and from 5.0.0 up to but not including 5.8.3 contain a vulnerability where app-based multi-factor authentication (MFA) management actions do not consistently require confirmation of the current password. This allows an attacker with access to an authenticated user session to modify app-based MFA settings or obtain recovery codes without knowing the account password. Email-based MFA is not affected, and the vulnerability does not allow unauthenticated sign-in. The issue is fixed in versions 4.13.3 and 5.8.3.

CVE-2026-14983 is a vulnerability in Teledyne FLIR Aware2 versions up to 6.9.0.2 where the web interface lacks authentication for a critical reboot function. This allows remote unauthenticated attackers to cause denial of service by misusing the reboot endpoint on Teledyne FLIR PackBot robots running the affected software.

Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setup.  An unauthenticated adjacent attacker can submit unauthorized wireless configuration parameters, causing the camera to attempt connection to a different network. Successful exploitation disconnects the camera from its intended wireless network, making it unreachable on its management address, resulting in a denial-of-service condition.

Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS onboarding scan function due to missing authentication. After initial setup, an unauthenticated attacker on the same local network can invoke the scan action and retrieve nearby wireless access-point metadata, including SSIDs, BSSIDs, authentication and encryption modes, and signal-strength information. Successful exploitation may disclose information about the wireless environment surrounding the camera, allowing an attacker to learn elements of the local wireless topology.

CVE-2026-48005 is a high-severity vulnerability in Apache HTTP Server versions 2.4.0 through 2.4.68. It involves missing authentication checks in the mod_auth_digest module when Digest authentication is enabled with the AuthDigestNcCheck option. This flaw allows unauthenticated remote attackers to cause a denial of service by forcing re-authentication via forged Authorization headers. The issue is fixed in version 2.4.69.

CVE-2026-13043 is a critical missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard Endpoint Security products. It allows a local, authenticated attacker to bypass the driver's access-control handshake and execute arbitrary privileged commands, leading to disclosure of kernel and process memory. The vulnerability affects versions prior to 8.00.26.0012. A fix is available in version 8.00.26.0012.

CVE-2026-96577 is a vulnerability in the oc-mirror component of Red Hat OpenShift Container Platform 4.18. The embedded local cache registry improperly binds to all network interfaces without authentication or encryption during mirroring operations. This misconfiguration allows an unauthenticated attacker on an adjacent network to connect to the service and potentially push tampered container images, delete cached images, or access mirrored content.

The Comelit 1456B Multi-User Gateway firmware versions 2.9.1 and 2.10.0 have a vulnerability where the network-accessible management interface does not require authentication. This allows a remote, unauthenticated attacker to read sensitive device configuration data, including the Remote Configuration Password, in cleartext.

Hitachi Coding Software Suite contains a vulnerability related to Missing Authentication for Critical Function. This allows an unauthenticated attacker to invoke a critical API, potentially leading to unauthorized retrieval or alteration of sensitive information, or unauthorized manipulation. This issue affects Hitachi Coding Software Suite: through 3.3.0.

Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions

CVE-2026-102110 is a medium severity vulnerability in Kiteworks Core where an endpoint used during initial appliance setup lacks authentication and does not enforce its intended state precondition. This allows an unauthenticated network attacker to repeatedly trigger the privileged activation process during the initial activation window, potentially disrupting setup and leaving the appliance incompletely configured. The vulnerability is only exploitable during the first-time activation of the appliance and is not accessible afterward.

CVE-2026-102121 is a high-severity vulnerability in Kiteworks Secure Data Forms where an unauthenticated form-rendering interface exposes more data than intended. Published forms accessible to anonymous users could leak the form owner's account profile and some deployment configuration details, but no passwords, authentication tokens, or multi-factor authentication secrets were exposed.

CVE-2026-102124 is a vulnerability in the Kiteworks Core appliance setup interface where authentication is not enforced after initial configuration. This allows an unauthenticated attacker with network access to read and modify certain setup records such as contact name and email address. The vulnerability affects versions prior to 9.5.0. The CVSS score is 6.5, indicating a medium severity impact with limited confidentiality and integrity impact but no availability impact.