CWE-304 Missing Critical Step in Authentication
Description
The product implements an authentication technique, but it skips a step that weakens the technique.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-304 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-m5pq-69xg-vcq3 | CVE-2026-54723 | MODERATE |
devpi-server may leak database contents |
2026-08-18 | |
| GHSA-v468-qcjx-r72w | CVE-2026-40542 | HIGH |
Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification |
2026-04-29 | |
| GHSA-5gjg-jgh4-gppm | CVE-2021-4236 | CRITICAL |
Websocket requests did not call AuthenticateMethod |
2026-01-23 | |
| GHSA-gx77-xgc2-4888 | CVE-2025-34351 | CRITICAL |
Ray's New Token Authentication is Disabled By Default |
2025-12-01 | |
| GHSA-4p5r-3jmm-652q | CVE-2025-43798 | LOW |
Liferay DXP Missing Critical Step in Authentication |
2025-09-15 | |
| GHSA-89px-ww3j-g2mm | CVE-2019-16766 | MODERATE |
2FA bypass in Wagtail through new device path |
2024-11-19 | |
| GHSA-fhr7-8jx4-r9cp | CVE-2023-3628 | HIGH |
Infinispan REST Server's bulk read endpoints do not properly evaluate user permissions |
2024-11-18 | |
| GHSA-r4w2-hjmr-36m7 | CVE-2023-3629 | HIGH |
Infinispan REST Server's cache retrieval endpoints do not properly evaluate the necessary admin permissions |
2024-11-18 | |
| GHSA-4m6j-23p2-8c54 | CVE-2024-1735 | CRITICAL |
Armeria SAML authentication bypass due to missing validation on unsigned SAML messages |
2024-02-26 | |
| GHSA-97g8-xfvw-q4hg | CVE-2022-3916 | MODERATE |
Keycloak vulnerable to session takeover with OIDC offline refreshtokens |
2023-09-20 |