CWE-304

Missing Critical Step in Authentication
AI Translation Available

The product implements an authentication technique, but it skips a step that weakens the technique.

Status
draft
Abstraction
base

Authentication techniques should follow the algorithms that define them exactly, otherwise authentication can be bypassed or more easily subjected to brute force attacks.

Common Consequences

access control integrity confidentiality
Impacts
bypass protection mechanism gain privileges or assume identity read application data execute unauthorized code or commands

Detection Methods

automated static analysis

Potential Mitigations