CWE-305: Authentication Bypass by Primary Weakness

A valid authentication algorithm does not ensure effective protection when another weakness alters, truncates, or otherwise undermines the implemented verification process. Because the primary weakness occurs in underlying implementation logic or state handling, an attacker may supply input that is accepted without satisfying the intended authentication requirements. Analysis should therefore address the root cause of the authentication failure, not only the nominal correctness of the authentication algorithm.

This is a simple, base-level weakness introduced during implementation, when an architectural security tactic is realized incorrectly. The authentication algorithm itself may be sound, while an underlying implementation defect, such as incomplete password comparison or improper data initialization, weakens the entire authentication mechanism. The record identifies it as not language-specific.

The primary consequence is an access-control impact: an attacker can bypass the protection mechanism provided by authentication. Successful exploitation may permit access that should require valid authentication, including administrative access in the representative example involving forum software.

The official CWE record does not specify mitigations for this weakness.

The official CWE record does not specify detection methods for this weakness.

The following are representative examples in the CWE record, not an exhaustive list:

• CVE-2002-1374: The supplied password was compared only with the first character of the real password.
• CVE-2000-0979: The password was not checked correctly, allowing remote attackers to bypass access controls with a one-byte password matching the first character of the real password.
• CVE-2001-0088: Forum software failed to initialize an array properly, inadvertently setting the password to a single character and allowing remote attackers to guess it easily and obtain administrative privileges.