CWE-308 Use of Single-factor Authentication
baseThe product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (29)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-58240US | critical9.8 | — | ||
SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network… | ||||
| CVE-2025-64103US | critical9.8 | — | ||
Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers. If a… | ||||
| CVE-2026-111884US | high8.3 | — | ||
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData,… | ||||
| CVE-2024-47652US | high8.1 | — | ||
This vulnerability exists in Shilpi Client Dashboard due to implementation of inadequate authentication mechanism in the login module wherein access to any users account is granted… | ||||
| CVE-2013-7180US | high7.8 | — | ||
Cobham SAILOR 900 VSAT; SAILOR FleetBroadBand 150, 250, and 500; EXPLORER BGAN; and AVIATOR 200, 300, 350, and 700D devices do not properly restrict password recovery, which allows… | ||||
| CVE-2002-1654US | high7.5 | — | ||
iPlanet Web Server Enterprise Edition and Netscape Enterprise Server 4.0 and 4.1 allows remote attackers to conduct HTTP Basic Authentication via the wp-force-auth Web Publisher co… | ||||
| CVE-2023-49075US | high7.2 | — | ||
The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundle\Security\PimcoreUserTwoFactorCondition` introduced in v11 disable the two factor authentication for all non… | ||||
| CVE-2018-12334US | high7.5 | — | ||
Protection Mechanism Failure in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to compromise authentication and encryption keys via a virtualization attack. | ||||
| CVE-2020-24515US | medium6.8 | — | ||
Protection mechanism failure in some Intel(R) RealSense(TM) IDs may allow an unauthenticated user to potentially enable escalation of privilege via physical access. | ||||
| CVE-2023-25681US | medium6.5 | — | ||
LDAP users on IBM Spectrum Virtualize 8.5 which are configured to require multifactor authentication can still authenticate to the CIM interface using only username and password. T… | ||||
| CVE-2023-34228US | medium6.5 | — | ||
In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actions | ||||
| CVE-2025-20892US | medium5.9OT elevated | — | ||
Protection Mechanism Failure in bootloader prior to SMR Jan-2025 Release 1 allows physical attackers to allow to execute fastboot command. User interaction is required for triggeri… | ||||
| CVE-2023-50934US | medium5.3 | — | ||
IBM PowerSC 1.3, 2.0, and 2.1 uses single-factor authentication which can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication sch… | ||||
| CVE-2020-4128US | medium5.3 | — | ||
HCL Domino is susceptible to a lockout policy bypass vulnerability in the ID Vault service. An unauthenticated attacker could use this vulnerability to mount a brute force attack a… | ||||
| CVE-2020-4129US | medium5.3 | — | ||
HCL Domino is susceptible to a lockout policy bypass vulnerability in the LDAP service. An unauthenticated attacker could use this vulnerability to mount a brute force attack again… | ||||
| CVE-2020-3461US | medium5.3OT elevated | — | ||
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to obtain confidential information… | ||||
| CVE-2006-3410US | medium5.0 | — | ||
Tor before 0.1.1.20 creates "internal circuits" primarily consisting of nodes with "useful exit nodes," which allows remote attackers to conduct unspecified statistical attacks. | ||||
| CVE-2024-50618US | medium4.3 | — | ||
A Use of Single-factor Authentication vulnerability in the Authentication component of CIPPlanner CIPAce before 9.17 allows attackers to bypass a protection mechanism. When the sys… | ||||
| CVE-2026-33550US | low2.6 | — | ||
SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended). | ||||
| CVE-2026-57490US | — | — | ||
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV B… | ||||
03
attack patterns (14)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan