In general, in the absence of a reason to the contrary, an individual parent can consent to medical care for the parent's child, even if the other parent wouldn't have agreed to it. This is where to begin the analysis.
Often, when parents aren't married there is a custody decree from a court that spells out who does and does not have custody of a child with respect to issues like medical care, but it does not appear that this is the case here.
The way paternity law works is that there are certain circumstances which cause someone to be presumed to be a parent until disproven (a couple of which are conclusive presumptions that can't be overcome with facts at some point), but a lack of a presumption doesn't mean that you aren't a parent, just that it is harder to prove that you are a parent.
Someone who is, or is presumed to be, a parent, continues to be a parent until that status is legally terminated (usually in a legal proceeding, but sometimes by operation of law). Since you are an actual parent, you continue to be a parent and have that authority, until that status in terminated for purposes of the law or until a court order limits your parental authority.
A lack of a father's name on a birth certificate does not create a presumption that a child does not have a father or that you are not a father, although the name of a different man on a birth certificate does create a presumption which can become conclusive at some point, that the person named on the birth certificate is the father.
Often this presumption becomes conclusive after five years, although I haven't (as I write this) confirmed that this is the case in New York. It isn't clear from the question if there is a different man named as a father on the birth certificate although it sounds as if it simply fails to name any father. And, often paternity petitions are disfavored or disallowed once a child turns eighteen for at least some purposes.
A written acknowledgement of paternity delivered to the appropriate vital statistics record keeping office can establish paternity if not contested. The standard version of this form must be signed by both parents, in each case before two witnesses.
The extent to which you are acknowledged as the parent of the child by the mother and others, and the extent to which you are involved in a child's life is also relevant to legal paternity, because a termination of parental rights can proceed in the absence of showing these things. The fact that the child share's your last name and that you are actively involved enough in the child's life to make it seem unlikely that this could be established even if a proceeding was brought, and in the absence of a formal termination of parental rights proceeding, you would not normally have your legal status as a parent terminated.
So, probably, you are legally the child's parent whose authority is not limited by any custody decree, and therefore, you are entitled to authorize a vaccination. But, for a wide variety of reasons, it would be prudent to have your paternity formally established under the law if you are going to have an ongoing involvement in your child's life.
Also, as DaleM notes, if you have the child with you, even if you are not the legal parent, you would usually be considered "in loco parentis" and have the authority to do this even in the absence of actual paternity.