CWEweakness

CWE-308 Use of Single-factor Authentication

High Official page ↗
Abstraction
Base
Structure
Simple
Status
Draft
Likelihood of exploit
High
Languages
Not Language-Specific
CWE version
5.0

Description

The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.

Common consequences

• Access Control: Bypass Protection Mechanism — If the secret in a single-factor authentication scheme gets compromised, full authentication is possible.

Potential mitigations

• [Architecture and Design] Use multiple independent authentication schemes, which ensures that -- if one of the methods is compromised -- the system itself is still likely safe from compromise. For this reason, if multiple schemes are possible, they should be implemented and required -- especially if they are easy to use.

Observed examples

• CVE-2022-35248: Chat application skips validation when Central Authentication Service (CAS) is enabled, effectively removing the second factor from two-factor authentication

Related

Attack pattern · CAPEC (14)

  • CAPEC-16 Dictionary-based Password Attack attack pattern
  • CAPEC-49 Password Brute Forcing attack pattern
  • CAPEC-509 Kerberoasting attack pattern
  • CAPEC-55 Rainbow Table Password Cracking attack pattern
  • CAPEC-555 Remote Services with Stolen Credentials attack pattern
  • CAPEC-560 Use of Known Domain Credentials attack pattern
  • CAPEC-561 Windows Admin Shares with Stolen Credentials attack pattern
  • CAPEC-565 Password Spraying attack pattern
  • CAPEC-600 Credential Stuffing attack pattern
  • CAPEC-644 Use of Captured Hashes (Pass The Hash) attack pattern
  • CAPEC-645 Use of Captured Tickets (Pass The Ticket) attack pattern
  • CAPEC-652 Use of Known Kerberos Credentials attack pattern
  • CAPEC-653 Use of Known Operating System Credentials attack pattern
  • CAPEC-70 Try Common or Default Usernames and Passwords attack pattern

Observed example · CVE (1)

  • CVE-2022-35248 A improper authentication vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 that allowed two factor authentication can be… vulnerability

Child of · CWE (2)

  • CWE-1390 Weak Authentication weakness
  • CWE-654 Reliance on a Single Factor in a Security Decision weakness

Peer of · CWE (1)

  • CWE-309 Use of Password System for Primary Authentication weakness

Referenced by CAPEC · weakness (14)

  • CAPEC-16 Dictionary-based Password Attack attack pattern
  • CAPEC-49 Password Brute Forcing attack pattern
  • CAPEC-509 Kerberoasting attack pattern
  • CAPEC-55 Rainbow Table Password Cracking attack pattern
  • CAPEC-555 Remote Services with Stolen Credentials attack pattern
  • CAPEC-560 Use of Known Domain Credentials attack pattern
  • CAPEC-561 Windows Admin Shares with Stolen Credentials attack pattern
  • CAPEC-565 Password Spraying attack pattern
  • CAPEC-600 Credential Stuffing attack pattern
  • CAPEC-644 Use of Captured Hashes (Pass The Hash) attack pattern
  • CAPEC-645 Use of Captured Tickets (Pass The Ticket) attack pattern
  • CAPEC-652 Use of Known Kerberos Credentials attack pattern
  • CAPEC-653 Use of Known Operating System Credentials attack pattern
  • CAPEC-70 Try Common or Default Usernames and Passwords attack pattern

Referenced by CVE · weakness (21)

  • CVE-2026-90862 Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows… vulnerability
  • CVE-2026-111884 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user… vulnerability
  • CVE-2026-57490 FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. vulnerability
  • CVE-2026-107808 Nginx UI is a web user interface for the Nginx web server. vulnerability
  • CVE-2026-79763 Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. vulnerability
  • CVE-2026-58240 SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. vulnerability
  • CVE-2026-85590 phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication (TOTP) disable functionality. vulnerability
  • CVE-2026-67611 OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent… vulnerability
  • CVE-2026-15616 Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants… vulnerability
  • CVE-2026-56022 Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of… vulnerability
  • CVE-2024-27928 vantage6 is an open-source infrastructure for privacy preserving analysis. vulnerability
  • CVE-2026-45749 Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. vulnerability
  • CVE-2026-33550 SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20… vulnerability
  • CVE-2024-50618 A Use of Single-factor Authentication vulnerability in the Authentication component of CIPPlanner CIPAce before 9.17 allows attackers to… vulnerability
  • CVE-2025-64103 Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled… vulnerability
  • CVE-2025-42959 An unauthenticated attacker may exploit a scenario where a Hashed Message Authentication Code (HMAC) credential, extracted from a system… vulnerability
  • CVE-2024-47652 This vulnerability exists in Shilpi Client Dashboard due to implementation of inadequate authentication mechanism in the login module… vulnerability
  • CVE-2023-25681 LDAP users on IBM Spectrum Virtualize 8.5 which are configured to require multifactor authentication can still authenticate to the CIM… vulnerability
  • CVE-2023-50934 IBM PowerSC 1.3, 2.0, and 2.1 uses single-factor authentication which can lead to unnecessary risk of compromise when compared with the… vulnerability
  • CVE-2023-49075 The Admin Classic Bundle provides a Backend UI for Pimcore. vulnerability
  • CVE-2023-34228 In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actions vulnerability

Referenced by CWE · has member (1)

Referenced by CWE · peer of (1)

  • CWE-309 Use of Password System for Primary Authentication weakness

Referenced by OWASP · mapped cwe (1)

  • A07:2025 Authentication Failures Top 10 2025