Skip to content
Log inStart free trial

CWE-304: Missing Critical Step in Authentication

Base

The product implements an authentication technique, but it skips a step that weakens the technique.

Authentication techniques should follow the algorithms that define them exactly, otherwise authentication can be bypassed or more easily subjected to brute force attacks.

Consequences

  • Access Control, Integrity, Confidentiality: Bypass Protection Mechanism, Gain Privileges or Assume Identity, Read Application Data, Execute Unauthorized Code or Commands

Recent advisories

  • GHSA-97g8-xfvw-q4hg — Keycloak vulnerable to session takeover with OIDC offline refreshtokens

All advisories for CWE-304

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor