Anyone can send one. A stranger on the internet who knows the URL can issue a request without credentials, and the server decides what to do with it. For a public home page the answer is fine. For an admin function, the right answer is to refuse.
Vulnerabilities that can be reached with an unauthenticated request are treated as the most serious. There is no account to steal and no password to guess, so an attacker can try the exploit against every server that is reachable. Scoring systems reflect this, with lower complexity and no required privileges giving a higher severity.
The code that runs before authentication is therefore the most important code to get right, since every visitor reaches it. This includes request parsing, upload handling and routing.
When an advisory says that a flaw is exploitable without authentication, assume it will be scanned for widely, check whether the affected component is reachable from the internet, and prioritize the fix or the temporary restriction.