Unauthorized access is accessing a system, network, or data without permission — a federal crime in the US (Computer Fraud and Abuse Act), even if the system is not properly secured.
CFAA criminalizes unauthorized access regardless of system security posture. "Authorized user exceeding authorization" is also covered. Good faith security researchers need careful authorization documentation to avoid prosecution.