CWEweakness

CWE-325 Missing Cryptographic Step

Official page ↗
Abstraction
Base
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.

Common consequences

• Access Control: Bypass Protection Mechanism • Confidentiality, Integrity: Read Application Data, Modify Application Data • Accountability, Non-Repudiation: Hide Activities

Detection methods

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Observed examples

• CVE-2001-1585: Missing challenge-response step allows authentication bypass using public key.

Related

Attack pattern · CAPEC (1)

  • CAPEC-68 Subvert Code-signing Facilities attack pattern

Observed example · CVE (1)

  • CVE-2001-1585 SSH protocol 2 (aka SSH-2) public key authentication in the development snapshot of OpenSSH 2.3.1, available from 2001-01-18 through… vulnerability

Child of · CWE (2)

  • CWE-1240 Use of a Cryptographic Primitive with a Risky Implementation weakness
  • CWE-573 Improper Following of Specification by Caller weakness

Peer of · CWE (1)

  • CWE-358 Improperly Implemented Security Check for Standard weakness

Referenced by CAPEC · weakness (1)

  • CAPEC-68 Subvert Code-signing Facilities attack pattern

Referenced by CVE · weakness (68)

  • CVE-2026-109839 IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector… vulnerability
  • CVE-2026-101294 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a… vulnerability
  • CVE-2026-107785 Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key. vulnerability
  • CVE-2026-16000 Missing cryptographic step in the DSTU 7624 CCM mode implementation (KCcmBlockCipher) in Legion of the Bouncy Castle Inc. vulnerability
  • CVE-2026-100798 Cryptography misuse in Storage: Quota Manager component. vulnerability
  • CVE-2026-96552 A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. vulnerability
  • CVE-2026-81235 Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Cryptographic Step vulnerability. vulnerability
  • CVE-2026-25250 EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic Step" associated with "Secure Boot disable." vulnerability
  • CVE-2026-76784 Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol. vulnerability
  • CVE-2026-17666 Cryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to bypass… vulnerability
  • CVE-2026-59776 Missing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips shipped in or before 2017. vulnerability
  • CVE-2026-55144 Missing cryptographic step in Windows CryptoAPI allows an authorized attacker to perform tampering locally. vulnerability
  • CVE-2026-58638 Missing cryptographic step in Windows Boot Loader allows an authorized attacker to bypass a security feature locally. vulnerability
  • CVE-2026-6458 Missing cryptographic step in Caliptra Core Firmware (aes_256_gcm_update module) results in an incorrect GCM authentication tag. vulnerability
  • CVE-2026-49440 Deno is a JavaScript, TypeScript, and WebAssembly runtime. vulnerability
  • CVE-2026-9266 A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and… vulnerability
  • CVE-2026-0420 An improper implementation of TLS certificate validation vulnerability found in NETGEAR's ReadyCloud client app which could allow an… vulnerability
  • CVE-2026-42770 Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup… vulnerability
  • CVE-2026-45445 Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied… vulnerability
  • CVE-2026-45446 Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD (Additional… vulnerability
  • CVE-2026-48480 The netty incubator codec.bhttp is a java language binary http parser. vulnerability
  • CVE-2026-42246 Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. vulnerability
  • CVE-2026-41395 OpenClaw before 2026.3.28 contains a webhook replay vulnerability in Plivo V3 signature verification that canonicalizes query ordering for… vulnerability
  • CVE-2026-40542 Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256… vulnerability
  • CVE-2026-29142 SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to forge a GINA-encrypted email. vulnerability
  • CVE-2026-4601 Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash… vulnerability
  • CVE-2026-4258 Versions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve… vulnerability
  • CVE-2026-28498 Authlib is a Python library which builds OAuth and OpenID Connect servers. vulnerability
  • CVE-2025-47383 Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE. vulnerability
  • CVE-2025-69418 Issue summary: When using the low-level OCB API directly with AES-NI or<br>other hardware-accelerated code paths, inputs whose length is… vulnerability
Show all 68 ›

Referenced by CWE · child of (1)

  • CWE-1431 Driving Intermediate Cryptographic State/Results to Hardware Module Outputs weakness

Referenced by CWE · has member (1)

Referenced by OWASP · mapped cwe (2)

  • A04:2025 Cryptographic Failures Top 10 2025
  • A02:2021 Cryptographic Failures Top 10 2021