Authentication Errors
A category in the Common Weakness Enumeration published by The MITRE Corporation.
Summary
Categories in the Common Weakness Enumeration (CWE) group entries based on some common characteristic or attribute.
Weaknesses in this category are related to authentication components of a system. Frequently these deal with the ability to verify that an entity is indeed who it claims to be. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authentication capability.
Weaknesses
A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it t...
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
A product requires authentication, but the product has an alternate path or channel that does not require authentication.
The product uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.
The product does not validate, or incorrectly validates, a certificate.
The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.
The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resou...
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute fo...
The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
The product performs a key exchange with an actor without verifying the identity of that actor.
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
The product implements an authentication technique, but it skips a step that weakens the technique.
The product contains an account lockout protection mechanism, but the mechanism is too restrictive and can be triggered too easily, which allows attackers to deny serv...
A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client tha...
The product records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store.
The use of password systems as the primary means of authentication may be subject to several flaws or shortcomings, each reducing the effectiveness of the mechanism.
The use of single-factor authentication can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme.
Concepts
This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development l...
Common Weakness Enumeration content on this website is copyright of The MITRE Corporation unless otherwise specified. Use of the Common Weakness Enumeration and the associated references on this website are subject to the Terms of Use as specified by The MITRE Corporation.