CWE-304 — Missing Critical Step in Authentication
CWE-304: Missing Critical Step in Authentication
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Base |
| Status | Draft |
| Likelihood of exploit | — |
Description
The product implements an authentication technique, but it skips a step that weakens the technique.
Authentication techniques should follow the algorithms that define them exactly, otherwise authentication can be bypassed or more easily subjected to brute force attacks.
Common consequences
- Access Control, Integrity, Confidentiality: Bypass Protection Mechanism, Gain Privileges or Assume Identity, Read Application Data, Execute Unauthorized Code or Commands
Mitigations
(none listed)
References
- CWE page: https://cwe.mitre.org/data/definitions/304.html
- CWE list: https://cwe.mitre.org/data/index.html