CWE-305 - Authentication Bypass by Primary Weakness

Home/CWEs/CWE info/

CWE-305

Abstraction:
Base

Structure:
Simple

Status:
Draft

Weakness Name: Authentication Bypass by Primary Weakness

Description: The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

Common Consequences: Scope: Access Control
Impact: Bypass Protection Mechanism

Related Weaknesses: CWE-1390Weak Authentication

Release Date:
2006-07-19

Latest Modification Date:
2023-06-29

Top Security News

Recorded Future CEO applauds "undesirable" designation by Russia

CISA orders federal agencies to secure Microsoft 365 tenants

Google Chrome uses AI to analyze pages in new scam detection feature

Rspack npm Packages Compromised with Crypto Mining Malware in Supply Chain Attack

Lazarus Group Spotted Targeting Nuclear Engineers with CookiePlus Malware

Apache Tomcat Vulnerability CVE-2024-56337 Exposes Servers to RCE Attacks

Exploit released for critical WhatsUp Gold RCE flaw, patch now

Microsoft fixes exploited zero-day (CVE-2024-49138)

Common Alerts

HighXML External Entity Attack

LowStrict-Transport-Security Header Not Set

MediumHTTP to HTTPS Insecure Transition in Form Post

LowInsufficient Site Isolation Against Spectre Vulnerability

MediumX-Frame-Options Defined via META (Non-compliant with Spec)

MediumCSP: script-src unsafe-hashes

MediumInformation Disclosure - JWT in Browser localStorage

LowCross-Domain JavaScript Source File Inclusion

MediumSub Resource Integrity Attribute Missing

MediumAnti-CSRF Tokens Check

Latest CVE List

CVE-2021-44207 Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability

CVE-2024-12356 BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability

CVE-2018-14933 NUUO NVRmini Devices OS Command Injection Vulnerability

CVE-2022-23227 NUUO NVRmini 2 Devices Missing Authentication Vulnerability

CVE-2019-11001 Reolink Multiple IP Cameras OS Command Injection Vulnerability

CVE-2021-40407 Reolink RLC-410W IP Camera OS Command Injection Vulnerability

CVE-2024-55956 Cleo Multiple Products Unauthenticated File Upload Vulnerability

CVE-2024-20767 Adobe ColdFusion Improper Access Control Vulnerability

CVE-2024-35250 Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability

CVE-2024-50623 Cleo Multiple Products Unrestricted File Upload Vulnerability

Common CWEs

CWE-1300 Improper Protection of Physical Side Channels

CWE-626 Null Byte Interaction Error (Poison Null Byte)

CWE-577 EJB Bad Practices: Use of Sockets

HighCWE-640 Weak Password Recovery Mechanism for Forgotten Password

CWE-304 Missing Critical Step in Authentication

CWE-773 Missing Reference to Active File Descriptor or Handle

CWE-1224 Improper Restriction of Write-Once Bit Fields

CWE-1068 Inconsistency Between Implementation and Documented Design

HighCWE-294 Authentication Bypass by Capture-replay

CWE-164 Improper Neutralization of Internal Special Elements

Free security scan for your website

Don't show website scan report rating on the leaderboard

CWE-305 - Authentication Bypass by Primary Weakness

The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.