An unauthenticated endpoint is a web page, API route, or service path that can be reached without proving identity first. It may be intentional, such as a public login page or status check, but it can also be a mistake when an internal or sensitive function is left exposed.
In cyber security, these endpoints matter because they expand the attack surface. Attackers often look for forgotten admin routes, legacy API handlers, or debug functions that respond to direct requests. If a system depends on authentication but a route bypasses it, a tool or browser may access data or actions without any exploit beyond finding the URL. Defenders reduce this risk with access control reviews, endpoint inventories, authentication tests, and removal of unused routes.