CWE-308: Use of Single-factor Authentication
The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- sonicwall sonicos, sonicos sslvpn +1 more An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid... 7.5 High
- No product listed Umami 2FA Policy route.ts single-factor authentication 5.3 Medium
- progress software ws ftp server Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server 4.3 Medium
- thorsten phpmyfaq phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover 8.7 High
- error311 filerise FileRise: WebDAV authentication bypasses TOTP/MFA entirely 8.1 High
- nginxui nginx ui, 0xjacky nginx-ui +1 more Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass) 8.1 High
- termix-ssh termix Termix: MFA-critical operations accept the account password as a sole factor (regression of CVE-2026-45749) 5.3 Medium
- sap se netweaver (message server) Missing Authentication check in SAP NetWeaver (Message Server) 9.8 Critical
- thorsten phpmyfaq phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable 7.1 High
- open-emr openemr OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration 8.6 High
- logto Local MFA not enforced during SSO sign-in 9.1 Critical
- webmin Webmin MFA bypass 6.9 Medium
- termix Termix's TOTP two-factor authentication can be disabled or bypassed using only the account password 8.1 High
- vantage6 Vantage6: 2FA can be circumvented with hacked email access 5.9 Medium
- alinto sogo SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short... 2.0 Low
- cipplanner cipace A Use of Single-factor Authentication vulnerability in the Authentication component of CIPPlanner... 4.3 Medium
- zitadel Zitadel Bypass Second Authentication Factor 8.7 High
- sap se netweaver abap server and abap platform Missing Authentication check after implementation of SAP Security Note 3007182 and 3537476 8.1 High
- shilpi computers client dashboard Insecure Authentication Vulnerability 7.6 High
- ibm webmethods integration IBM webMethods Integration privilege escalation 8.8 High
- ibm spectrum virtualize IBM Spectrum Virtualize security bypass 5.3 Medium
- ibm powersc IBM PowerSC improper authentication 5.3 Medium
- pimcore admin classic bundle, admin-ui-classic-bundle +1 more Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls 8.5 High
- jetbrains teamcity In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for... 5.3 Medium