> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flintai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Missing auth on endpoint

> Agent server or API endpoint exposed without authentication or TLS

Agent server or API endpoint exposed without authentication or TLS

## How to resolve

Enable TLS on all agent endpoints. Implement authentication (OAuth 2.0, API key verification) and restrict binding to specific network interfaces.

## Risk

**Governance/Compliance**

This vulnerability falls under [ASI03:2026 — Identity and Privilege Abuse](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/) in the OWASP Top 10 for Agentic Applications. Agents inherit, reuse, or escalate identities and credentials beyond their functional scope.

**Security**

Agent server or API endpoint exposed without authentication or TLS. If exploited, this can compromise the agent's integrity, confidentiality, or availability, potentially affecting downstream systems and data.

## Explanation

Agent server or API endpoint exposed without authentication or TLS. This falls under ASI03 (Identity and Privilege Abuse): Agents inherit, reuse, or escalate identities and credentials beyond their functional scope.

## Specifications

**Trigger**

* Agent scan detects agent server or API endpoint exposed without authentication or TLS

The scanner looks for patterns such as:

* app.run() with no auth middleware
* uvicorn.run(host='0.0.0.0') with no token check
* FastAPI/Flask routes with no authentication decorator
* HTTP server binding to 0.0.0.0

**Severity**

* CRITICAL

**Applies to**: Agent