CWEweakness

CWE-1390 Weak Authentication

Official page ↗
Abstraction
Class
Structure
Simple
Status
Incomplete
Languages
Go, Not Language-Specific
CWE version
5.0

Description

The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

Common consequences

• Integrity, Confidentiality, Availability, Access Control: Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands — Attackers may be able to bypass weak authentication faster and/or with less effort than expected. This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.

Observed examples

• CVE-2024-48445: Chain: e-commerce app relies on an easily-guessable timestamp (CWE-341) in a weak authentication algorithm (CWE-1390) • CVE-2022-30034: Chain: Web UI for a Python RPC framework does not use regex anchors to validate user login emails (CWE-777), potentially allowing bypass of OAuth (CWE-1390). • CVE-2022-35248: Chat application skips validation when Central Authentication Service (CAS) is enabled, effectively removing the second factor from two-factor authentication • CVE-2021-3116: Chain: Python-based HTTP Proxy server uses the wrong boolean operators (CWE-480) causing an incorrect comparison (CWE-697) that identifies an authN failure if all three conditions are met instead of only one, allowing bypass of the proxy authentication (CWE-1390) • CVE-2022-29965: Distributed Control System (DCS) uses a deterministic algorithm to generate utility passwords • CVE-2022-29959: Initialization file contains credentials that can be decoded using a "simple string transformation" • CVE-2020-8994: UART interface for AI speaker uses empty password for root shell

Related

Observed example · CVE (7)

  • CVE-2024-48445 An issue in compop.ca ONLINE MALL v.3.5.3 allows a remote attacker to execute arbitrary code via the rid, tid, et, and ts parameters. vulnerability
  • CVE-2022-35248 A improper authentication vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 that allowed two factor authentication can be… vulnerability
  • CVE-2022-29959 Emerson OpenBSI through 2022-04-29 mishandles credential storage. vulnerability
  • CVE-2022-29965 The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. vulnerability
  • CVE-2022-30034 Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. vulnerability
  • CVE-2021-3116 before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data… vulnerability
  • CVE-2020-8994 An issue was discovered on XIAOMI AI speaker MDZ-25-DT 1.34.36, and 1.40.14. vulnerability

Child of · CWE (1)

  • CWE-287 Improper Authentication weakness

Referenced by CVE · weakness (117)

  • CVE-2026-115967 Weak Authentication vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Authentication Abuse.This issue… vulnerability
  • CVE-2025-30414 Local privilege escalation due to improper authentication. vulnerability
  • CVE-2026-110475 This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the… vulnerability
  • CVE-2026-69802 Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network. vulnerability
  • CVE-2026-69982 Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a… vulnerability
  • CVE-2026-70005 Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a… vulnerability
  • CVE-2026-83511 Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. vulnerability
  • CVE-2026-83586 Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges… vulnerability
  • CVE-2026-83657 Weak authentication in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally. vulnerability
  • CVE-2026-83674 Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. vulnerability
  • CVE-2026-83681 Weak authentication in Microsoft PowerToys allows an authorized attacker to perform tampering locally. vulnerability
  • CVE-2026-83840 Weak authentication in Windows Error Reporting allows an authorized attacker to elevate privileges locally. vulnerability
  • CVE-2026-85323 Weak authentication in Network Device Enrollment Service (NDES) allows an authorized attacker to perform spoofing over a network. vulnerability
  • CVE-2026-85328 Weak authentication in Windows Projected File System allows an authorized attacker to elevate privileges locally. vulnerability
  • CVE-2026-85376 Weak authentication in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. vulnerability
  • CVE-2026-85922 Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network. vulnerability
  • CVE-2026-85939 Weak authentication in Windows Kernel allows an authorized attacker to bypass a security feature over a network. vulnerability
  • CVE-2026-88101 Weak authentication in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally. vulnerability
  • CVE-2026-96940 Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. vulnerability
  • CVE-2026-93355 LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to… vulnerability
  • CVE-2026-92288 Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token… vulnerability
  • CVE-2026-92289 Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode… vulnerability
  • CVE-2026-94455 An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. vulnerability
  • CVE-2026-62895 Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network. vulnerability
  • CVE-2026-73025 Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network. vulnerability
  • CVE-2026-77483 Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network. vulnerability
  • CVE-2026-73819 The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's… vulnerability
  • CVE-2026-44476 Doorkeeper is an OAuth 2 provider for Ruby on Rails. vulnerability
  • CVE-2026-65098 NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an attacker could cause weak authentication. vulnerability
  • CVE-2026-59135 Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally. vulnerability
Show all 117 ›

Referenced by CWE · can precede (1)

  • CWE-41 Improper Resolution of Path Equivalence weakness

Referenced by CWE · child of (20)

  • CWE-1391 Use of Weak Credentials weakness
  • CWE-262 Not Using Password Aging weakness
  • CWE-263 Password Aging with Long Expiration weakness
  • CWE-289 Authentication Bypass by Alternate Name weakness
  • CWE-290 Authentication Bypass by Spoofing weakness
  • CWE-294 Authentication Bypass by Capture-replay weakness
  • CWE-301 Reflection Attack in an Authentication Protocol weakness
  • CWE-302 Authentication Bypass by Assumed-Immutable Data weakness
  • CWE-303 Incorrect Implementation of Authentication Algorithm weakness
  • CWE-305 Authentication Bypass by Primary Weakness weakness
  • CWE-307 Improper Restriction of Excessive Authentication Attempts weakness
  • CWE-308 Use of Single-factor Authentication weakness
  • CWE-309 Use of Password System for Primary Authentication weakness
  • CWE-522 Insufficiently Protected Credentials weakness
  • CWE-593 Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created weakness
  • CWE-603 Use of Client-Side Authentication weakness
  • CWE-620 Unverified Password Change weakness
  • CWE-640 Weak Password Recovery Mechanism for Forgotten Password weakness
  • CWE-804 Guessable CAPTCHA weakness
  • CWE-836 Use of Password Hash Instead of Password for Authentication weakness

Referenced by CWE · has member (1)

  • CWE-1468 Weaknesses Addressed by the OWASP Golang Secure Coding Practices Guide view

Referenced by OWASP · mapped cwe (1)

  • A07:2025 Authentication Failures Top 10 2025