CWEweakness

CWE-836 Use of Password Hash Instead of Password for Authentication

Official page ↗
Abstraction
Base
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific
CWE version
5.0

Description

The product includes a client that computes a hash of a password and sends the hash to another component, which compares the supplied hash to the hash obtained from a data store of password hashes.

Common consequences

• Access Control, Authentication: Bypass Protection Mechanism, Gain Privileges or Assume Identity — An attacker could bypass the authentication routine without knowing the original password. The attacker could obtain a copy of the hash (e.g., through a separate weakness against a database of authentication credentials), then use a modified client to replay the stolen hash. As a result, the server-side comparison against a client-side hash does not provide any more security than the use of passwords without hashing.

Observed examples

• CVE-2009-1283: Product performs authentication with user-supplied password hashes that can be obtained from a separate SQL injection vulnerability (CVE-2009-1282). • CVE-2005-3435: Product allows attackers to bypass authentication by obtaining the password hash for another user and specifying the hash in the pwd argument.

Related

Attack pattern · CAPEC (2)

  • CAPEC-644 Use of Captured Hashes (Pass The Hash) attack pattern
  • CAPEC-652 Use of Known Kerberos Credentials attack pattern

Observed example · CVE (2)

  • CVE-2009-1283 glFusion before 1.1.3 performs authentication with a user-provided password hash instead of a password, which allows remote attackers to… vulnerability
  • CVE-2005-3435 admin_news.php in Archilles Newsworld up to 1.3.0 allows attackers to bypass authentication by obtaining the password hash for another… vulnerability

Child of · CWE (1)

Peer of · CWE (1)

  • CWE-602 Client-Side Enforcement of Server-Side Security weakness

Referenced by CAPEC · weakness (2)

  • CAPEC-644 Use of Captured Hashes (Pass The Hash) attack pattern
  • CAPEC-652 Use of Known Kerberos Credentials attack pattern

Referenced by CVE · weakness (18)

  • CVE-2026-63158 Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored… vulnerability
  • CVE-2026-46488 motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion… vulnerability
  • CVE-2026-44736 OpenProject is open-source, web-based project management software. vulnerability
  • CVE-2026-9222 Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only require the password hash when authenticating with… vulnerability
  • CVE-2026-40103 Vikunja is an open-source self-hosted task management platform. vulnerability
  • CVE-2019-25552 CEWE PHOTO SHOW 6.4.3 contains a denial of service vulnerability that allows attackers to crash the application by submitting an… vulnerability
  • CVE-2025-64471 A use of password hash instead of password for authentication vulnerability [CWE-836] vulnerability in Fortinet FortiWeb 8.0.0 through… vulnerability
  • CVE-2025-62618 ELOG allows an authenticated user to upload arbitrary HTML files. vulnerability
  • CVE-2025-52543 E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication. vulnerability
  • CVE-2025-48925 The TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to do MD5 hashing, and then accepts the hash… vulnerability
  • CVE-2023-39546 CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X… vulnerability
  • CVE-2023-4299 Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment. vulnerability
  • CVE-2023-34132 Use of password hash instead of password for authentication vulnerability in SonicWall GMS and Analytics allows Pass-the-Hash attacks. vulnerability
  • CVE-2023-23450 Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216,… vulnerability
  • CVE-2023-23614 Pi-hole®'s Web interface (based off of AdminLTE) provides a central location to manage your Pi-hole. vulnerability
  • CVE-2022-32282 An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. vulnerability
  • CVE-2021-23857 Login with hash: The login routine allows the client to log in to the system not by using the password, but by using the hash of the… vulnerability
  • CVE-2017-7927 A Use of Password Hash Instead of Password for Authentication issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN,… vulnerability