VulnScan

CWE-1390: Weak Authentication

What is CWE-1390?

MITRE CWE

The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

Verify to analyze this CWE entry

A short verification protects the official data source and prevents automated AI abuse.

Official definition

MITRE CWE

The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

Attackers may be able to bypass weak authentication faster and/or with less effort than expected.

Detailed description

CyStack is analyzing this CWE entry. The page will update automatically when the bilingual analysis is ready.

Characteristics

CyStack is analyzing this CWE entry. The page will update automatically when the bilingual analysis is ready.

Modes of introduction

  • Architecture and Design
  • Implementation

Common consequences

CyStack is analyzing this CWE entry. The page will update automatically when the bilingual analysis is ready.

  • Integrity, Confidentiality, Availability, Access Control

    Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands

    This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.

Mitigations

CyStack is analyzing this CWE entry. The page will update automatically when the bilingual analysis is ready.

Detection methods

CyStack is analyzing this CWE entry. The page will update automatically when the bilingual analysis is ready.

Representative vulnerabilities

CyStack is analyzing this CWE entry. The page will update automatically when the bilingual analysis is ready.

These examples illustrate this CWE entry and are not an exhaustive list of related vulnerabilities.

  • CVE-2024-48445Chain: e-commerce app relies on an easily-guessable timestamp (CWE-341) in a weak authentication algorithm (CWE-1390)
  • CVE-2022-30034Chain: Web UI for a Python RPC framework does not use regex anchors to validate user login emails (CWE-777), potentially allowing bypass of OAuth (CWE-1390).
  • CVE-2022-35248Chat application skips validation when Central Authentication Service (CAS) is enabled, effectively removing the second factor from two-factor authentication
  • CVE-2021-3116Chain: Python-based HTTP Proxy server uses the wrong boolean operators (CWE-480) causing an incorrect comparison (CWE-697) that identifies an authN failure if all three conditions are met instead of only one, allowing bypass of the proxy authentication (CWE-1390)
  • CVE-2022-29965Distributed Control System (DCS) uses a deterministic algorithm to generate utility passwords
  • CVE-2022-29959Initialization file contains credentials that can be decoded using a "simple string transformation"
  • CVE-2020-8994UART interface for AI speaker uses empty password for root shell

Sources and references

References

CWE™ Program, operated by The MITRE Corporation. Copyright © 2006–2026, The MITRE Corporation. The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. CWE Terms of Use.

Learn more

Run an in-depth assessment with complete web risk management

CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.

Explore CyStack VulnScan
CyStack VulnScan dashboard