CWE-308—Use of Single-factor Authentication

Weakness Name

Use of Single-factor Authentication

Description

The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.

Common Consequences

Scope:

Access Control

Impact:

Bypass Protection Mechanism

Notes:

If the secret in a single-factor authentication scheme gets compromised, full authentication is possible.

Related Weaknesses

• CWE-309Use of Password System for Primary AuthenticationHigh
• CWE-654Reliance on a Single Factor in a Security Decision
• CWE-1390Weak Authentication