CWEweakness

CWE-304 Missing Critical Step in Authentication

Official page ↗
Abstraction
Base
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product implements an authentication technique, but it skips a step that weakens the technique.

Common consequences

• Access Control, Integrity, Confidentiality: Bypass Protection Mechanism, Gain Privileges or Assume Identity, Read Application Data, Execute Unauthorized Code or Commands — This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or allowing attackers to execute arbitrary code.

Detection methods

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Observed examples

• CVE-2004-2163: Shared secret not verified in a RADIUS response packet, allowing authentication bypass by spoofing server replies. • CVE-2005-3327: Chain: Authentication bypass by skipping the first startup step as required by the protocol.

Related

Observed example · CVE (2)

  • CVE-2005-3327 Network Appliance Data ONTAP 7.0 and earlier allows iSCSI Initiators to bypass iSCSI authentication via a modified client that skips the… vulnerability
  • CVE-2004-2163 login_radius on OpenBSD 3.2, 3.5, and possibly other versions does not verify the shared secret in a response packet from a RADIUS server,… vulnerability

Child of · CWE (2)

  • CWE-303 Incorrect Implementation of Authentication Algorithm weakness
  • CWE-573 Improper Following of Specification by Caller weakness

Referenced by CVE · weakness (49)

  • CVE-2026-113438 Pleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain… vulnerability
  • CVE-2026-101296 A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL… vulnerability
  • CVE-2026-108071 Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. vulnerability
  • CVE-2026-73535 Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in… vulnerability
  • CVE-2026-89068 Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). vulnerability
  • CVE-2026-93994 Apache MINA SSHD is a Java library for client-side and server-side SSH. vulnerability
  • CVE-2026-94052 A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5… vulnerability
  • CVE-2026-100667 grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed… vulnerability
  • CVE-2026-54723 devpi is a Python package index staging server and packaging, testing, and release tool. vulnerability
  • CVE-2023-54391 Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that… vulnerability
  • CVE-2026-59564 An authentication bypass issue exists in communications between affected versions of the Zscaler Client Connector and the Zscaler Client… vulnerability
  • CVE-2026-76207 phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification… vulnerability
  • CVE-2026-49467 Pingvin Share X is a secure and easy self-hosted file sharing platform. vulnerability
  • CVE-2026-61466 In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the… vulnerability
  • CVE-2026-67351 Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate… vulnerability
  • CVE-2026-61143 Vulnerability in the Oracle Communications Convergent Charging Controller product of Oracle Communications (component: Prov IF). vulnerability
  • CVE-2026-55957 Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI… vulnerability
  • CVE-2026-57915 It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported… vulnerability
  • CVE-2026-44547 ChurchCRM is an open-source church management system. vulnerability
  • CVE-2026-42452 Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. vulnerability
  • CVE-2026-40542 Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256… vulnerability
  • CVE-2026-30831 Rocket.Chat is an open-source, secure, fully customizable communications platform. vulnerability
  • CVE-2025-43798 Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time… vulnerability
  • CVE-2025-24322 An unsafe default authentication vulnerability exists in the Initial Setup Authentication functionality of Tenda AC6 V5.0 V02.03.01.110. vulnerability
  • CVE-2025-55138 LinkJoin through 882f196 mishandles token ownership in password reset. vulnerability
  • CVE-2024-52965 A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5,… vulnerability
  • CVE-2025-5715 A vulnerability was found in Signal App 7.41.4 on Android. vulnerability
  • CVE-2025-43014 In JetBrains Toolbox App before 2.6 the SSH plugin established connections without sufficient user confirmation vulnerability
  • CVE-2024-11302 A missing check_access() function in the lollms_binding_infos module of the parisneo/lollms repository, version V14, allows attackers to… vulnerability
  • CVE-2024-12048 An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. vulnerability
Show all 49 ›

Referenced by CWE · has member (1)

Referenced by OWASP · mapped cwe (2)

  • A07:2025 Authentication Failures Top 10 2025
  • A07:2021 Identification and Authentication Failures Top 10 2021