CWE-306 (关键功能的认证机制缺失) — Vulnerability Class 1920

CWE-306 represents a critical authentication weakness where software fails to verify user identity before executing sensitive operations or consuming substantial resources. Attackers typically exploit this vulnerability by directly invoking administrative endpoints, initiating high-cost processes, or accessing restricted data without valid credentials, effectively bypassing security controls. This oversight allows unauthorized users to perform actions intended only for authenticated individuals, leading to privilege escalation, data breaches, or denial of service through resource exhaustion. To mitigate this risk, developers must implement robust access control mechanisms that strictly enforce authentication checks on all critical functions. This involves integrating secure session management, validating tokens for every request, and applying the principle of least privilege to ensure that only verified users with appropriate permissions can trigger sensitive operations or consume significant system resources.