CWE-306: Missing Authentication for Critical Functionality
Sources read 2026-10-30. MITRE's own page · All weakness notes · Added to CISA's list in the last seven days
What it is
From MITRE's CWE catalogue
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
MITRE classes it as a base-level weakness and rates the likelihood of exploit as high.
What it lets an attacker do
From MITRE's CWE catalogue
- Gain Privileges or Assume Identity, Varies by Context (affects: access control, other)
On CISA's exploited list
From CISA's exploited list
5 of the 110 entries CISA added from 2026-08-02 to 2026-10-30 name CWE-306, against 4 of 69 in the 90 days before. Over the whole catalogue 43 entries name it. The counts are small, so read them as a rough order, not a rate.
CISA's list is not every flaw that is exploited: it holds the ones CISA has evidence of, listed on the day it added them.
- CVE-2026-111357, Ivanti Connect Secure, added 2026-10-30
- CVE-2026-67277, MikroTik RouterOS, added 2026-09-10
- CVE-2026-59822, BerriAI LiteLLM, added 2026-09-02
- CVE-2026-81578, PaperCut NG/MF, added 2026-08-31
- CVE-2026-72529, TrueConf Server, added 2026-08-20
How MITRE says to find it
From MITRE's CWE catalogue
- Manual Analysis
- Automated Static Analysis
- Manual Static Analysis - Binary or Bytecode
- Dynamic Analysis with Automated Results Interpretation
- Dynamic Analysis with Manual Results Interpretation
What MITRE suggests
From MITRE's CWE catalogue
These are MITRE's suggestions, quoted as it gives them. They are not a complete fix and not a substitute for reading the vendor's advisory for the product you run.
- Architecture and Design: Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability.
- Architecture and Design: For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602.
- Architecture and Design: Where possible, avoid implementing custom, "grow-your-own" authentication routines and consider using authentication capabilities as provided by the surrounding framework, operating system, or environment. These capabilities may avoid common weaknesses that are unique to authentication;
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator [REF-45].
Attack patterns MITRE links to it
From MITRE's CWE catalogue
Our notes that name it
From our own notes
Start with one piece of work.
Give us one piece of work and read access to one system. We map it and come back with what we found, what we would build and what it would take — before any commitment. You decide using our output, not our pitch.
Talk to us