Missing Authentication
CWE-306: Missing Authentication for Critical Function
Missing authentication for a critical function means a feature that should require a verified identity, such as changing configuration, managing users, or running maintenance tasks, can be called by anyone who can reach it. It differs from missing authorization because the software never asks who the caller is at all. It is common in embedded devices, industrial systems, and internal APIs built on the assumption that the network itself is trusted.
Ranks change between editions as the underlying CVE data changes, so exam questions rarely hinge on an exact rank. Know what each weakness is, how it is exploited, and how it is prevented.
How it shows up in the real world
- A firmware update endpoint on an IoT camera accepts new firmware from any client on the network.
- A password reset API sets a new password for any username supplied, with no token or session required.
- An orchestration or database admin port is exposed to the internet with authentication disabled by default.
How to mitigate it
- Require authentication for every function that changes state or exposes sensitive data, enforced on the server.
- Do not rely on network location as a substitute for authentication; apply zero trust principles to internal services.
- Use strong, centrally managed authentication such as SSO, mutual TLS, or signed tokens for service-to-service calls.
- Inventory all endpoints, including undocumented and legacy ones, and test each one unauthenticated.
Go deeper
Practice this topic
Test your knowledge of Missing Authentication with exam-style practice questions.