{
  "node_id": "mitre-cwe-306-missing-authentication-for-critical-function",
  "title": "MITRE CWE-306 - Missing Authentication for Critical Function",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2026-06-05",
  "bluf": "CWE-306 (Missing Authentication for Critical Function) is a CWE Top 25 weakness consistently associated with unauthenticated admin interfaces, exposed management ports, internal APIs leaked to the internet, and exposed cloud metadata or storage endpoints. CWE-306 is defined as: the product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. The Extended Description identifies common scenarios where the weakness arises: developers failing to implement authentication mechanisms for critical operations; creating secondary communication channels assumed to be private without requiring authentication; allowing access to administrative or privileged functionality without identity verification; and failing to authenticate across all interaction channels or connection types. Common Consequences include access control impact (exposing critical functionality provides attackers with elevated privilege levels; consequences range from reading and modifying sensitive data to executing arbitrary code or accessing administrative functions); and privilege escalation (an attacker can assume the identity and privileges associated with unprotected critical functions, depending on the specific functionality involved). Potential Mitigations include architecture and design (divide software into anonymous, normal, privileged, and administrative areas; implement centralized authentication for areas requiring proven identity); multi-channel protection (identify all communication channels and ensure authentication applies consistently across all of them); server-side validation (duplicate client-side security checks on the server to prevent bypass attempts); framework usage (use established authentication libraries - OpenSSL, ESAPI - rather than custom authentication routines); and cloud security (implement provider controls requiring strong authentication for cloud-stored data access).",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "industry_mapping",
      "related_frameworks"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "mitre-cwe-287-improper-authentication"
  ],
  "primary_citations_count": 12
}