Cyber Posture

CWE · MITRE source

CWE-306Missing Authentication for Critical Function

Abstraction: Base · CVEs in our corpus: 2,218

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Last updated: 09 May 2026 03:25 UTC

NIST 800-53 r5 controls that address this weakness (43)AI

Showing the 15 most specific. Generic controls that address many weakness types are collapsed below.

Control Title Family Why it addresses this CWE
IA-1Policy and ProceduresIAThe policy mandates identification and authentication for critical functions, making missing authentication less likely.
IA-10Adaptive AuthenticationIAMandates additional authentication for access under defined conditions, ensuring critical or high-risk functions are not left without authentication.
IA-11Re-authenticationIARe-authentication enforces fresh credential validation for critical functions or operations as defined by the organization parameter.
SA-14Criticality AnalysisSAExplicit identification of critical functions enables organizations to ensure authentication is applied exactly where it is most needed, preventing missing authentication for those functions.
SA-16Developer-provided TrainingSATraining emphasizes enabling and properly using authentication for critical functions, reducing missing authentication exposures.
SA-17Developer Security and Privacy Architecture and DesignSADemands complete description of required security functionality, making omission of authentication for critical functions far less likely.
SC-14Public Access ProtectionsSCRequires authentication gates on critical functions that must remain unavailable to anonymous public users.
SC-15Collaborative Computing Devices and ApplicationsSCTreats remote activation of surveillance-capable devices as a critical function that must be disabled or authenticated.
SC-19Voice Over Internet ProtocolSCRequiring authorization before VoIP deployment prevents critical VoIP functions (registration, call setup) from lacking authentication.
AC-11Device LockACRequires established identification and authentication to unlock, mitigating missing authentication for continued system access.
AC-14Permitted Actions Without Identification or AuthenticationACRequiring identification and rationale for actions allowed without authentication ensures critical functions are not left unprotected by forcing review of authentication requirements.
AC-19Access Control for Mobile DevicesACAuthorizing mobile device connections to organizational systems ensures authentication is performed for this critical access function.
PE-10Emergency ShutoffPEThe shutoff is a critical function, and the control ensures it cannot be activated without proper (physical) authentication.
PE-3Physical Access ControlPERequires verification of individual access authorizations before granting facility entry, addressing missing authentication for critical physical access.
PE-7Visitor ControlPEImplements authentication steps (ID checks, sign-in, escort verification) for physical access to critical functions or locations.
Show 28 more broadly-applicable controls
IA-13Identity Providers and Authorization ServersIAIdentity providers mandate authentication for functions that would otherwise lack it.
IA-2Identification and Authentication (Organizational Users)IAMandates authentication for organizational users and their associated processes, eliminating missing authentication for critical functions.
IA-3Device Identification and AuthenticationIARequires authentication of devices prior to connection, preventing exploitation of missing authentication for critical network functions.
IA-7Cryptographic Module AuthenticationIAMandates authentication for the critical function of accessing or using a cryptographic module.
IA-8Identification and Authentication (Non-organizational Users)IARequires authentication for non-organizational users, preventing access to critical functions without proper identification and authentication.
IA-9Service Identification and AuthenticationIAMandates authentication prior to establishing communications with services, preventing missing authentication for this critical function.
SA-5System DocumentationSASecure configuration documentation explicitly addresses enabling authentication for critical functions, reducing missing authentication exposures.
SA-8Security and Privacy Engineering PrinciplesSAComplete-mediation principle requires authentication for critical functions.
SA-9External System ServicesSAMandating that external services employ specified authentication controls and ongoing compliance monitoring makes missing authentication for critical functions harder to overlook or exploit.
SC-26DecoysSCDecoy implementations of critical functions without authentication lure and record attackers probing for missing auth checks.
SC-43Usage RestrictionsSCRequiring authorization for listed components ensures authentication occurs before critical functions are invoked.
SC-7Boundary ProtectionSCPublic components are isolated in separate subnetworks and critical internal functions are reachable only via controlled interfaces.
AC-25Reference MonitorACGuarantees critical functions are protected by mandatory invocation of the access control mechanism.
PL-11Baseline TailoringPLTailoring determines which functions require authentication and selects the appropriate baseline or compensating authentication controls.
PL-4Rules of BehaviorPLRules require authentication prior to system or function access, making missing authentication for critical functions harder to ignore or bypass.
PL-8Security and Privacy ArchitecturesPLThe control requires architectures to identify and protect critical functions, including mandatory authentication for those functions.
RA-3Risk AssessmentRARisk assessments evaluate exposure of critical functions lacking authentication and prioritize corrective controls.
RA-5Vulnerability Monitoring and ScanningRATools routinely check for missing authentication on critical functions and exposed interfaces.
RA-9Criticality AnalysisRAExplicit identification of critical functions enables targeted authentication requirements, preventing missing authentication for those functions.
CA-2Control AssessmentsCAThe assessment process confirms authentication is present and effective for critical functions, preventing exploitation from missing authentication.
CA-4Security CertificationCACertification assesses that critical functions have required authentication controls in place.
PM-5System InventoryPMKnowing every system allows confirmation that critical functions are not left without required authentication mechanisms.
PM-8Critical Infrastructure PlanPMProtection planning for critical infrastructure directly calls for authentication of access to essential functions before any operation is permitted.
AU-14Session AuditAUAuditing sessions makes it possible to detect access to critical functions without required authentication.
CM-7Least FunctionalityCMDisabling non-essential functions and services eliminates the need to secure them, reducing exposure from missing authentication on unnecessary components.
MA-4Nonlocal MaintenanceMAMandating authentication for nonlocal maintenance addresses missing authentication for this critical function.
PS-1Policy and ProceduresPSPolicy mandates authentication and authorization for critical functions, ensuring these controls are not omitted for personnel-managed resources.
SI-9Information Input RestrictionsSIEnsures critical input functions cannot be reached without prior authorization.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2020-6287 KEV9.710.00.94392020-07-14
CVE-2024-51567 KEV9.710.00.94312024-10-29
CVE-2020-6207 KEV9.69.80.94152020-03-10
CVE-2020-3952 KEV9.69.80.94342020-04-10
CVE-2020-13927 KEV9.69.80.94102020-11-10
CVE-2020-10148 KEV9.69.80.94352020-12-29
CVE-2021-44077 KEV9.69.80.94302021-11-29
CVE-2021-35587 KEV9.69.80.94272022-01-19
CVE-2022-1388 KEV9.69.80.94462022-05-05
CVE-2022-21587 KEV9.69.80.94402022-10-18
CVE-2023-46747 KEV9.69.80.94442023-10-26
CVE-2024-47575 KEV9.69.80.93872024-10-23
CVE-2024-0012 KEV9.69.80.94282024-11-18
CVE-2024-11680 KEV9.69.80.93862024-11-26
CVE-2021-37415 KEV9.59.80.92952021-09-01
CVE-2023-42793 KEV9.59.80.92912023-09-19
CVE-2025-0108 KEV9.59.10.94122025-02-12
CVE-2025-3248 KEV9.59.80.91812025-04-07
CVE-2019-9082 KEV9.48.80.94252019-02-24
CVE-2021-39144 KEV9.48.50.94252021-08-23
CVE-2024-5910 KEV9.49.80.91032024-07-10
CVE-2022-26143 KEV9.39.80.89152022-03-10
CVE-2023-28461 KEV9.39.80.89292023-03-15
CVE-2017-10271 KEV9.27.50.94442017-10-19
CVE-2022-24990 KEV9.27.50.94402023-02-07