CWE-306Missing Authentication for Critical Function

Abstraction: Base · CVEs in our corpus: 3,008

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Last updated: 22 August 2026 20:22 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: full · 10 mapping(s) from 4 framework(s): CAPEC 4 (partial) · STIG rhel 8 2 (full) · STIG rhel 7 2 (mostly) · STIG oracle linux 8 2 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A07:2025 Authentication Failures.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

IA-1 Policy and Procedures
IA-10 Adaptive Authentication
IA-11 Re-authentication
IA-13 Identity Providers and Authorization Servers

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

6 hardening rules · 3 OS baselines

Validate

Prove the fix (OWASP ASVS)

V6.2.3
V6.4.4
V10.4.16
V12.1.3

NIST 800-53 r5 controls that address this weakness (43)AI-assisted

Showing the 15 most specific. Generic controls that address many weakness types are collapsed below.

Control	Title	Family	Why it addresses this CWE
`IA-1`	Policy and Procedures	IA	The policy mandates identification and authentication for critical functions, making missing authentication less likely.
`IA-10`	Adaptive Authentication	IA	Mandates additional authentication for access under defined conditions, ensuring critical or high-risk functions are not left without authentication.
`IA-11`	Re-authentication	IA	Re-authentication enforces fresh credential validation for critical functions or operations as defined by the organization parameter.
`SA-14`	Criticality Analysis	SA	Explicit identification of critical functions enables organizations to ensure authentication is applied exactly where it is most needed, preventing missing authentication for those functions.
`SA-16`	Developer-provided Training	SA	Training emphasizes enabling and properly using authentication for critical functions, reducing missing authentication exposures.
`SA-17`	Developer Security and Privacy Architecture and Design	SA	Demands complete description of required security functionality, making omission of authentication for critical functions far less likely.
`SC-14`	Public Access Protections	SC	Requires authentication gates on critical functions that must remain unavailable to anonymous public users.
`SC-15`	Collaborative Computing Devices and Applications	SC	Treats remote activation of surveillance-capable devices as a critical function that must be disabled or authenticated.
`SC-19`	Voice Over Internet Protocol	SC	Requiring authorization before VoIP deployment prevents critical VoIP functions (registration, call setup) from lacking authentication.
`AC-11`	Device Lock	AC	Requires established identification and authentication to unlock, mitigating missing authentication for continued system access.
`AC-14`	Permitted Actions Without Identification or Authentication	AC	Requiring identification and rationale for actions allowed without authentication ensures critical functions are not left unprotected by forcing review of authentication requirements.
`AC-19`	Access Control for Mobile Devices	AC	Authorizing mobile device connections to organizational systems ensures authentication is performed for this critical access function.
`PE-10`	Emergency Shutoff	PE	The shutoff is a critical function, and the control ensures it cannot be activated without proper (physical) authentication.
`PE-3`	Physical Access Control	PE	Requires verification of individual access authorizations before granting facility entry, addressing missing authentication for critical physical access.
`PE-7`	Visitor Control	PE	Implements authentication steps (ID checks, sign-in, escort verification) for physical access to critical functions or locations.

Show 28 more broadly-applicable controls

`IA-13`	Identity Providers and Authorization Servers	IA	Identity providers mandate authentication for functions that would otherwise lack it.
`IA-2`	Identification and Authentication (Organizational Users)	IA	Mandates authentication for organizational users and their associated processes, eliminating missing authentication for critical functions.
`IA-3`	Device Identification and Authentication	IA	Requires authentication of devices prior to connection, preventing exploitation of missing authentication for critical network functions.
`IA-7`	Cryptographic Module Authentication	IA	Mandates authentication for the critical function of accessing or using a cryptographic module.
`IA-8`	Identification and Authentication (Non-organizational Users)	IA	Requires authentication for non-organizational users, preventing access to critical functions without proper identification and authentication.
`IA-9`	Service Identification and Authentication	IA	Mandates authentication prior to establishing communications with services, preventing missing authentication for this critical function.
`SA-5`	System Documentation	SA	Secure configuration documentation explicitly addresses enabling authentication for critical functions, reducing missing authentication exposures.
`SA-8`	Security and Privacy Engineering Principles	SA	Complete-mediation principle requires authentication for critical functions.
`SA-9`	External System Services	SA	Mandating that external services employ specified authentication controls and ongoing compliance monitoring makes missing authentication for critical functions harder to overlook or exploit.
`SC-26`	Decoys	SC	Decoy implementations of critical functions without authentication lure and record attackers probing for missing auth checks.
`SC-43`	Usage Restrictions	SC	Requiring authorization for listed components ensures authentication occurs before critical functions are invoked.
`SC-7`	Boundary Protection	SC	Public components are isolated in separate subnetworks and critical internal functions are reachable only via controlled interfaces.
`AC-25`	Reference Monitor	AC	Guarantees critical functions are protected by mandatory invocation of the access control mechanism.
`PL-11`	Baseline Tailoring	PL	Tailoring determines which functions require authentication and selects the appropriate baseline or compensating authentication controls.
`PL-4`	Rules of Behavior	PL	Rules require authentication prior to system or function access, making missing authentication for critical functions harder to ignore or bypass.
`PL-8`	Security and Privacy Architectures	PL	The control requires architectures to identify and protect critical functions, including mandatory authentication for those functions.
`RA-3`	Risk Assessment	RA	Risk assessments evaluate exposure of critical functions lacking authentication and prioritize corrective controls.
`RA-5`	Vulnerability Monitoring and Scanning	RA	Tools routinely check for missing authentication on critical functions and exposed interfaces.
`RA-9`	Criticality Analysis	RA	Explicit identification of critical functions enables targeted authentication requirements, preventing missing authentication for those functions.
`CA-2`	Control Assessments	CA	The assessment process confirms authentication is present and effective for critical functions, preventing exploitation from missing authentication.
`CA-4`	Security Certification	CA	Certification assesses that critical functions have required authentication controls in place.
`PM-5`	System Inventory	PM	Knowing every system allows confirmation that critical functions are not left without required authentication mechanisms.
`PM-8`	Critical Infrastructure Plan	PM	Protection planning for critical infrastructure directly calls for authentication of access to essential functions before any operation is permitted.
`AU-14`	Session Audit	AU	Auditing sessions makes it possible to detect access to critical functions without required authentication.
`CM-7`	Least Functionality	CM	Disabling non-essential functions and services eliminates the need to secure them, reducing exposure from missing authentication on unnecessary components.
`MA-4`	Nonlocal Maintenance	MA	Mandating authentication for nonlocal maintenance addresses missing authentication for this critical function.
`PS-1`	Policy and Procedures	PS	Policy mandates authentication and authorization for critical functions, ensuring these controls are not omitted for personnel-managed resources.
`SI-9`	Information Input Restrictions	SI	Ensures critical input functions cannot be reached without prior authorization.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2010-5326` KEV	10.0	10.0	0.1745	2016-05-13
`CVE-2020-6287` KEV	10.0	10.0	0.9472	2020-07-14
`CVE-2024-51567` KEV	10.0	10.0	0.8652	2024-10-29
`CVE-2025-32433` KEV	10.0	10.0	0.9859	2025-04-16
`CVE-2025-34028` KEV	10.0	10.0	0.9766	2025-04-22
`CVE-2016-2004`	9.9	9.8	0.9425	2016-04-21
`CVE-2018-0127`	9.9	9.8	0.7748	2018-02-08
`CVE-2020-6207` KEV	9.9	9.8	0.9827	2020-03-10
`CVE-2020-3952` KEV	9.9	9.8	0.9038	2020-04-10
`CVE-2020-12720`	9.9	9.8	0.8895	2020-05-08
`CVE-2020-13927` KEV	9.9	9.8	0.9978	2020-11-10
`CVE-2020-10148` KEV	9.9	9.8	0.9198	2020-12-29
`CVE-2021-37415` KEV	9.9	9.8	0.9982	2021-09-01
`CVE-2021-38540`	9.9	9.8	0.8094	2021-09-09
`CVE-2021-33543`	9.9	9.8	0.8207	2021-09-13
`CVE-2021-44077` KEV	9.9	9.8	0.9330	2021-11-29
`CVE-2021-45232`	9.9	9.8	0.8594	2021-12-27
`CVE-2022-23227` KEV	9.9	9.8	0.4943	2022-01-14
`CVE-2021-35587` KEV	9.9	9.8	0.9628	2022-01-19
`CVE-2022-26143` KEV	9.9	9.8	0.8721	2022-03-10
`CVE-2022-26501` KEV	9.9	9.8	0.0410	2022-03-17
`CVE-2022-1388` KEV	9.9	9.8	0.9996	2022-05-05
`CVE-2022-21587` KEV	9.9	9.8	0.9834	2022-10-18
`CVE-2023-28461` KEV	9.9	9.8	0.6808	2023-03-15
`CVE-2023-42793` KEV	9.9	9.8	0.9998	2023-09-19