A category in the Common Weakness Enumeration published by The MITRE Corporation.
Categories in the Common Weakness Enumeration (CWE) group entries based on some common characteristic or attribute.
Weaknesses in this category are related to authentication components of a system. Frequently these deal with the ability to verify that an entity is indeed who it claims to be. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authentication capability.
A capture-replay flaw exists when the design of the software makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it ...
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks.
A product requires authentication, but the product has an alternate path or channel that does not require authentication.
The software uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.
The software does not validate, or incorrectly validates, a certificate.
The software does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.
The software does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any reso...
The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brut...
The requirements for the software dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
The software performs a key exchange with an actor without verifying the identity of that actor.
The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
The software implements an authentication technique, but it skips a step that weakens the technique.
The software contains an account lockout protection mechanism, but the mechanism is too restrictive and can be triggered too easily, which allows attackers to deny ser...
A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client tha...
The software records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data st...
The use of password systems as the primary means of authentication may be subject to several flaws or shortcomings, each reducing the effectiveness of the mechanism.
The use of single-factor authentication can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme.
This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development l...