It has no built-in authentication mechanisms because forwarding a port typically does not allow any activity that could not also be achieved using STUN methods.
It lacks built-in authentication mechanisms because forwarding a port typically does not enable any activity that could not also be accomplished using STUN methods.