CWE-306Missing Authentication for Critical Function

Abstraction: Base · CVEs in our corpus: 3,542

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Last updated: 16 October 2026 00:29 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: full · 6 mapping(s) from 3 framework(s): STIG rhel 8 2 (full) · STIG rhel 7 2 (mostly) · STIG oracle linux 8 2 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A07:2025 Authentication Failures.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

IA-1 Policy and Procedures
IA-10 Adaptive Authentication
IA-11 Re-authentication
IA-13 Identity Providers and Authorization Servers

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

6 hardening rules · 3 OS baselines

Validate

Prove the fix (OWASP ASVS)

V6.2.3
V6.4.4
V10.4.16
V12.1.3

NIST 800-53 r5 controls PROPOSED for this weakness (43)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Showing the 15 most specific. Generic controls that address many weakness types are collapsed below.

Control	Title	Family	Why it addresses this CWE
`IA-2`	Identification and Authentication (Organizational Users)	IA	graded full Mandates authentication for organizational users and their associated processes, eliminating missing authentication for critical functions.
`IA-8`	Identification and Authentication (Non-organizational Users)	IA	graded full Requires authentication for non-organizational users, preventing access to critical functions without proper identification and authentication.
`IA-9`	Service Identification and Authentication	IA	graded full Mandates authentication prior to establishing communications with services, preventing missing authentication for this critical function.
`AC-14`	Permitted Actions Without Identification or Authentication	AC	graded mostly Requiring identification and rationale for actions allowed without authentication ensures critical functions are not left unprotected by forcing review of authentication requirements.
`SA-14`	Criticality Analysis	SA	Explicit identification of critical functions enables organizations to ensure authentication is applied exactly where it is most needed, preventing missing authentication for those functions.
`SA-16`	Developer-provided Training	SA	Training emphasizes enabling and properly using authentication for critical functions, reducing missing authentication exposures.
`SA-17`	Developer Security and Privacy Architecture and Design	SA	Demands complete description of required security functionality, making omission of authentication for critical functions far less likely.
`SC-14`	Public Access Protections	SC	Requires authentication gates on critical functions that must remain unavailable to anonymous public users.
`SC-15`	Collaborative Computing Devices and Applications	SC	Treats remote activation of surveillance-capable devices as a critical function that must be disabled or authenticated.
`SC-19`	Voice Over Internet Protocol	SC	Requiring authorization before VoIP deployment prevents critical VoIP functions (registration, call setup) from lacking authentication.
`AC-11`	Device Lock	AC	Requires established identification and authentication to unlock, mitigating missing authentication for continued system access.
`AC-19`	Access Control for Mobile Devices	AC	Authorizing mobile device connections to organizational systems ensures authentication is performed for this critical access function.
`PE-10`	Emergency Shutoff	PE	The shutoff is a critical function, and the control ensures it cannot be activated without proper (physical) authentication.
`PE-3`	Physical Access Control	PE	Requires verification of individual access authorizations before granting facility entry, addressing missing authentication for critical physical access.
`PE-7`	Visitor Control	PE	Implements authentication steps (ID checks, sign-in, escort verification) for physical access to critical functions or locations.

Show 28 more broadly-applicable controls

`IA-1`	Policy and Procedures	IA	The policy mandates identification and authentication for critical functions, making missing authentication less likely.
`IA-10`	Adaptive Authentication	IA	Mandates additional authentication for access under defined conditions, ensuring critical or high-risk functions are not left without authentication.
`IA-11`	Re-authentication	IA	Re-authentication enforces fresh credential validation for critical functions or operations as defined by the organization parameter.
`IA-13`	Identity Providers and Authorization Servers	IA	Identity providers mandate authentication for functions that would otherwise lack it.
`IA-3`	Device Identification and Authentication	IA	Requires authentication of devices prior to connection, preventing exploitation of missing authentication for critical network functions.
`IA-7`	Cryptographic Module Authentication	IA	Mandates authentication for the critical function of accessing or using a cryptographic module.
`SA-5`	System Documentation	SA	Secure configuration documentation explicitly addresses enabling authentication for critical functions, reducing missing authentication exposures.
`SA-8`	Security and Privacy Engineering Principles	SA	Complete-mediation principle requires authentication for critical functions.
`SA-9`	External System Services	SA	Mandating that external services employ specified authentication controls and ongoing compliance monitoring makes missing authentication for critical functions harder to overlook or exploit.
`SC-26`	Decoys	SC	Decoy implementations of critical functions without authentication lure and record attackers probing for missing auth checks.
`SC-43`	Usage Restrictions	SC	Requiring authorization for listed components ensures authentication occurs before critical functions are invoked.
`SC-7`	Boundary Protection	SC	Public components are isolated in separate subnetworks and critical internal functions are reachable only via controlled interfaces.
`AC-25`	Reference Monitor	AC	Guarantees critical functions are protected by mandatory invocation of the access control mechanism.
`PL-11`	Baseline Tailoring	PL	Tailoring determines which functions require authentication and selects the appropriate baseline or compensating authentication controls.
`PL-4`	Rules of Behavior	PL	Rules require authentication prior to system or function access, making missing authentication for critical functions harder to ignore or bypass.
`PL-8`	Security and Privacy Architectures	PL	The control requires architectures to identify and protect critical functions, including mandatory authentication for those functions.
`RA-3`	Risk Assessment	RA	Risk assessments evaluate exposure of critical functions lacking authentication and prioritize corrective controls.
`RA-5`	Vulnerability Monitoring and Scanning	RA	Tools routinely check for missing authentication on critical functions and exposed interfaces.
`RA-9`	Criticality Analysis	RA	Explicit identification of critical functions enables targeted authentication requirements, preventing missing authentication for those functions.
`CA-2`	Control Assessments	CA	The assessment process confirms authentication is present and effective for critical functions, preventing exploitation from missing authentication.
`CA-4`	Security Certification	CA	Certification assesses that critical functions have required authentication controls in place.
`PM-5`	System Inventory	PM	Knowing every system allows confirmation that critical functions are not left without required authentication mechanisms.
`PM-8`	Critical Infrastructure Plan	PM	Protection planning for critical infrastructure directly calls for authentication of access to essential functions before any operation is permitted.
`AU-14`	Session Audit	AU	Auditing sessions makes it possible to detect access to critical functions without required authentication.
`CM-7`	Least Functionality	CM	Disabling non-essential functions and services eliminates the need to secure them, reducing exposure from missing authentication on unnecessary components.
`MA-4`	Nonlocal Maintenance	MA	Mandating authentication for nonlocal maintenance addresses missing authentication for this critical function.
`PS-1`	Policy and Procedures	PS	Policy mandates authentication and authorization for critical functions, ensuring these controls are not omitted for personnel-managed resources.
`SI-9`	Information Input Restrictions	SI	Ensures critical input functions cannot be reached without prior authorization.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2010-5326` KEV	10.0	10.0	0.1777	2016-05-13
`CVE-2020-6287` KEV	10.0	10.0	0.9472	2020-07-14
`CVE-2024-51567` KEV	10.0	10.0	0.8663	2024-10-29
`CVE-2025-32433` KEV	10.0	10.0	0.9879	2025-04-16
`CVE-2025-34028` KEV	10.0	10.0	0.9760	2025-04-22
`CVE-2016-2004`	9.9	9.8	0.9425	2016-04-21
`CVE-2018-0127`	9.9	9.8	0.7748	2018-02-08
`CVE-2020-6207` KEV	9.9	9.8	0.9813	2020-03-10
`CVE-2020-3952` KEV	9.9	9.8	0.9038	2020-04-10
`CVE-2020-12720`	9.9	9.8	0.8895	2020-05-08
`CVE-2020-13927` KEV	9.9	9.8	0.9978	2020-11-10
`CVE-2020-10148` KEV	9.9	9.8	0.9198	2020-12-29
`CVE-2021-37415` KEV	9.9	9.8	0.9982	2021-09-01
`CVE-2021-38540`	9.9	9.8	0.8094	2021-09-09
`CVE-2021-33543`	9.9	9.8	0.8134	2021-09-13
`CVE-2021-44077` KEV	9.9	9.8	0.9330	2021-11-29
`CVE-2021-45232`	9.9	9.8	0.8633	2021-12-27
`CVE-2022-23227` KEV	9.9	9.8	0.4850	2022-01-14
`CVE-2021-35587` KEV	9.9	9.8	0.9628	2022-01-19
`CVE-2022-26143` KEV	9.9	9.8	0.8732	2022-03-10
`CVE-2022-26501` KEV	9.9	9.8	0.0410	2022-03-17
`CVE-2022-1388` KEV	9.9	9.8	0.9995	2022-05-05
`CVE-2022-21587` KEV	9.9	9.8	0.9834	2022-10-18
`CVE-2023-28461` KEV	9.9	9.8	0.6808	2023-03-15
`CVE-2023-42793` KEV	9.9	9.8	0.9999	2023-09-19