CWE-308: Use of Single-factor Authentication

BaseLikelihood of exploit: High

The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.

Consequences

Access Control: Bypass Protection Mechanism

How to prevent it

Architecture and Design: Use multiple independent authentication schemes, which ensures that -- if one of the methods is compromised -- the system itself is still likely safe from compromise. For this reason, if multiple schemes are possible, they should be implemented and required -- especially if they are easy to use.

Recent advisories

GHSA-45gv-9wjv-xh7p — Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
GHSA-cfjq-28r2-4jv5 — Zitadel May Bypass Second Authentication Factor

All advisories for CWE-308

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor