Home / Knowledge hub / Unauthenticated access
Knowledge hub
Unauthenticated access
Anything your application answers without signing in at all.
What it means
Unauthenticated access is anything your application answers without the caller signing in. Some of it is deliberate: a marketing page, the login form itself, a health check.
The rest is the problem. An API route left open during development. An old export endpoint. A debug page. An admin panel resting on the hope that nobody learns the address. MITRE files that last one as CWE-306.
Why it matters
Attackers check this first, because it costs them nothing. No account to create, no rate limit to dodge, nothing to steal beforehand. Automated tools try common paths against every host they can reach.
It is also the easiest thing to leave behind. Somebody turns authentication off to debug a problem at eleven at night and never turns it back on. And it makes an awkward finding to explain, because there is no attack to describe. A person typed an address and the data arrived. Nothing about it takes skill, which is why automated tools turn it up so fast.
How it shows up
The test is blunt and worth repeating often. Take the list of every route your application serves, sign out, and call all of them. Anything that answers with real data is a finding.
Pay attention to routes that never appear in a menu: old API versions, files left over from a migration, internal tools sharing the same host. Remember what sits beside the application too, such as monitoring dashboards, log viewers and staging copies of the real database. Hiding a route is not protecting it, which is the point broken access control keeps making.
Questions people ask
Unauthenticated access, answered
Is a long random admin URL good enough?
No. A URL is not a credential. It leaks through browser history, referrer headers, bookmarks, screenshots and the person who left last quarter.
Put a real check behind the route. Keep the obscure address if you like it, but treat it as a speed bump rather than a lock.
How do attackers find endpoints that nothing links to?
They read your JavaScript bundle, which usually names every route the front end calls. They look for an OpenAPI or Swagger file, try GraphQL introspection, and brute-force common paths from wordlists.
Assume every route your application serves is discoverable, because in practice it is.
Our API is internal. Does it still need authentication?
Yes. Internal is a description of intent, not a control. Cloud networking changes, a service gets a public load balancer, somebody sets up a tunnel for a demo.
Every one of those turns an internal service into an exposed one, and the code has no idea it happened.
Is unauthenticated access always a vulnerability?
No. Your home page, your login form and your health check all answer without a login on purpose, and should.
The question is whether the route returns anything a stranger should not have, or performs an action a stranger should not trigger. If it does, it is a finding regardless of intent.
How is this different from broken access control?
Unauthenticated access is the case where no identity exists at all. Broken access control is the wider family, which also covers a signed-in user reaching something meant for another account or another role.
Same root cause, different starting point. The missing check simply sits further forward.
Related
Terms that sit next to this one
Authentication
Proving you are who you say you are. It answers one question only.
Broken access control
An application failing to enforce its own rules about who may do what.
Attack surface
Everything about your application an outsider can touch.
Enumeration
Working out what exists by asking repeatedly and watching the answers.
What answers when nobody signs in?
Cyberlop signs out, tries every route it can find, and hands you the ones that still returned data with the response attached. Start on one application for $199 over 30 days.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.