CVE-2026-91323

Explicitly identifies and limits actions permitted without authentication, preventing critical functions from being exposed.

Access enforcement requires prior authentication before any authorization decision for critical functions.

Directly mandates unique identification and authentication of users before access to functions requiring identity.

Extends the same authentication requirement to non-organizational users accessing critical functionality.

Requires authentication of services before they can invoke or expose critical functions.

Managing identities and credentials is a prerequisite for authentication but does not itself enforce it on critical functions.

Defining and enforcing authorizations assumes prior authentication and therefore only partially mitigates the absence of authentication.

Protecting networks from unauthorized access can be undermined by missing authentication but does not address the root authentication gap.

Mandating segregated approval and oversight for non-human identities reduces the chance that weak or orphaned credentials can be exploited for unauthorized authentication.

A.8.21 mandates authentication requirements for accessing network services and requires security measures (including authentication) to be identified and implemented, so applying it where it was not applied before results in authentication being added to network services that lacked it, removing those CWE-306 instances; however, A.8.21's scope is limited to network services while CWE-306 also covers non-network critical functions (UART debug ports, local APIs, backdoor channels), and the clause governs the requirement rather than directly implementing authentication, leaving a nameable remainder.

A.8.30 mandates contractual security requirements (point b referencing 8.25-8.29), acceptance testing (point d), and evidence of security capabilities (point e), which can require and verify that authentication is designed into outsourced deliverables before they ship — but it is a governance/oversight mechanism whose effect depends on the rigor of contract specification, acceptance test coverage, and developer compliance, so it prevents a slice rather than the bulk of instances.