CWEweakness

CWE-408 Incorrect Behavior Order: Early Amplification

Official page ↗
Abstraction
Base
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product allows an entity to perform a legitimate but expensive operation before authentication or authorization has taken place.

Common consequences

• Availability: DoS: Amplification, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory) — System resources, CPU and memory, can be quickly consumed. This can lead to poor system performance or system crash.

Observed examples

• CVE-2004-2458: Tool creates directories before authenticating user.

Related

Observed example · CVE (1)

  • CVE-2004-2458 Open WebMail 2.30 and earlier, when use_syshomedir is disabled or create_syshomedir is enabled, creates new directories before… vulnerability

Child of · CWE (2)

  • CWE-405 Asymmetric Resource Consumption (Amplification) weakness
  • CWE-696 Incorrect Behavior Order weakness

Referenced by CVE · weakness (9)

  • CVE-2026-104032 A flaw was found in SSSD. vulnerability
  • CVE-2026-11605 The issue is a resource exhaustion vulnerability associated with DNSSEC validation. vulnerability
  • CVE-2026-46015 In the Linux kernel, the following vulnerability has been resolved: tcp: call sk_data_ready() after listener migration When… vulnerability
  • CVE-2026-3592 BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. vulnerability
  • CVE-2026-41374 OpenClaw before 2026.3.31 performs Discord audio preflight transcription before validating member authorization, allowing unauthenticated… vulnerability
  • CVE-2026-41405 OpenClaw before 2026.3.31 parses MS Teams webhook request bodies before performing JWT validation, allowing unauthenticated attackers to… vulnerability
  • CVE-2026-41331 OpenClaw before 2026.3.31 contains a resource consumption vulnerability in Telegram audio preflight transcription that allows unauthorized… vulnerability
  • CVE-2022-2576 In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full handshake on a… vulnerability
  • CVE-2020-1657 On SRX Series devices, a vulnerability in the key-management-daemon (kmd) daemon of Juniper Networks Junos OS allows an attacker to spoof… vulnerability

Referenced by CWE · has member (1)