NIST 800-53 r5 · Controls catalogue · Family IA
IA-11Re-authentication
Require users to re-authenticate when {{ insert: param, ia-11_odp }}.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: mostly · 4 mapping(s) from 2 framework(s): ASVS 5.0 3 (partial) · CSF 2.0 1 (mostly)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (7)
- T1110 Brute Force Credential Access
- T1110.001 Password Guessing Credential Access
- T1110.002 Password Cracking Credential Access
- T1110.003 Password Spraying Credential Access
- T1110.004 Credential Stuffing Credential Access
- T1556.006 Multi-Factor Authentication Defense Impairment, Persistence, Credential Access
- T1556.007 Hybrid Identity Defense Impairment, Persistence, Credential Access
Weaknesses this control addresses (4)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-352 | Cross-Site Request Forgery (CSRF) | 10,576 | Requiring user re-entry of credentials for sensitive actions prevents automated forgery of requests without active user participation. |
CWE-306 | Missing Authentication for Critical Function | 2,820 | Re-authentication enforces fresh credential validation for critical functions or operations as defined by the organization parameter. |
CWE-613 | Insufficient Session Expiration | 642 | Re-authentication after inactivity or time-based triggers prevents indefinite use of potentially hijacked or stale sessions. |
CWE-384 | Session Fixation | 489 | Re-authentication typically forces issuance of a new session, limiting the window for exploitation of a previously fixed session identifier. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2025-0070 | 7.0 | 9.9 | 0.0067 | good |
CVE-2024-33699 | 7.0 | 9.9 | 0.0922 | good |
CVE-2026-33124 | 5.5 | 8.8 | 0.0025 | good |
CVE-2024-53406 | 5.5 | 8.8 | 0.0059 | good |
CVE-2026-40588 | 5.5 | 8.1 | 0.0022 | good |
CVE-2026-24440 | 5.5 | 8.8 | 0.0027 | good |
CVE-2026-27757 | 5.5 | 7.1 | 0.0025 | good |
CVE-2024-40119 | 5.5 | 8.8 | 0.0050 | good |
CVE-2024-56116 | 5.5 | 8.8 | 0.0036 | good |
CVE-2024-25723 UPD | 8.0 | 8.8 | 0.7058 | partial |
CVE-2023-53968 | 7.0 | 9.8 | 0.0056 | good |
CVE-2026-35903 | 7.0 | 9.8 | 0.0049 | good |
CVE-2024-54530 | 7.0 | 9.1 | 0.0055 | partial |
CVE-2025-1941 | 7.0 | 9.1 | 0.0034 | good |
CVE-2025-69634 | 7.0 | 9.0 | 0.0014 | partial |
CVE-2025-4322 UPD | 7.0 | 9.8 | 0.1824 | good |
CVE-2026-4924 | 5.5 | 8.2 | 0.0033 | good |
CVE-2026-33649 | 5.5 | 8.1 | 0.0017 | good |
CVE-2025-25928 | 5.5 | 8.0 | 0.0027 | partial |
CVE-2026-35625 | 5.5 | 7.8 | 0.0019 | good |
CVE-2026-29132 | 5.5 | 7.5 | 0.0025 | good |
CVE-2024-34896 | 5.5 | 7.5 | 0.0036 | partial |
CVE-2025-25068 | 5.5 | 7.5 | 0.0032 | good |
CVE-2026-27939 | 5.5 | 8.8 | 0.0039 | good |
CVE-2026-24443 | 5.5 | 8.8 | 0.0046 | good |