CWE-1390: Weak Authentication
Description
The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.
Attackers may be able to bypass weak authentication faster and/or with less effort than expected.
- Abstraction
- ClassAn abstract weakness, independent of any specific language or technology.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Incomplete
Common consequences
- IntegrityConfidentialityAvailabilityAccess Control
Read Application Data; Gain Privileges or Assume Identity; Execute Unauthorized Code or Commands
This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.
Related weaknesses
Parent weaknesses
Child weaknesses
- CWE-41Improper Resolution of Path Equivalence
- CWE-262Not Using Password Aging
- CWE-263Password Aging with Long Expiration
- CWE-289Authentication Bypass by Alternate Name
- CWE-290Authentication Bypass by Spoofing
- CWE-294Authentication Bypass by Capture-replay
- CWE-301Reflection Attack in an Authentication Protocol
- CWE-302Authentication Bypass by Assumed-Immutable Data
- CWE-303Incorrect Implementation of Authentication Algorithm
- CWE-305Authentication Bypass by Primary Weakness
- CWE-307Improper Restriction of Excessive Authentication Attempts
- CWE-308Use of Single-factor Authentication
- CWE-309Use of Password System for Primary Authentication
- CWE-522Insufficiently Protected Credentials
- CWE-593Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
- CWE-603Use of Client-Side Authentication
- CWE-620Unverified Password Change
- CWE-640Weak Password Recovery Mechanism for Forgotten Password
- CWE-804Guessable CAPTCHA
- CWE-836Use of Password Hash Instead of Password for Authentication
- CWE-1391Use of Weak Credentials
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.