Common Weakness Enumeration

CWE-308 Use of Single-factor Authentication

Description

The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.

Associated Reviewed Advisories

Vulnerabilities classified under CWE-308 ordered by modification date.

4 reviewed records

Advisory ID	NVD ID	Severity	PURLs	Summary	Last Modified
GHSA-45gv-9wjv-xh7p	CVE-2026-107808	HIGH	golang/github.com/0xJacky/Nginx-UI	Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)	2026-10-09
GHSA-4c5c-2vc3-x5w2	CVE-2024-27928	MODERATE	pypi/vantage6	Vantage6: 2FA can be circumvented with hacked email access	2026-06-05
GHSA-cfjq-28r2-4jv5	CVE-2025-64103	HIGH	golang/github.com/zitadel/zitadel golang/github.com/zitadel/zitadel/v2	Zitadel May Bypass Second Authentication Factor	2025-11-05
GHSA-9wwg-r3c7-4vfg	CVE-2023-49075	HIGH	-	Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls	2023-11-28