CWE-303Incorrect Implementation of Authentication Algorithm

Abstraction: Base · CVEs in our corpus: 117

The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

This incorrect implementation may allow authentication to be bypassed.

Last updated: 14 October 2026 20:41 UTC

OWASP Top 10 for Web (2025)

This weakness contributes to A07:2025 Authentication Failures.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.PS-06
SA-11 Developer Testing and Evaluation
SA-15 Development Process, Standards, and Tools
IA-5 Authenticator Management

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls PROPOSED for this weakness (0)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2023-29357` KEV	9.9	9.8	0.9998	2023-06-14
`CVE-2024-7593` KEV	9.9	9.8	1.0000	2024-08-13
`CVE-2020-8863`	9.1	8.8	0.7673	2020-03-23
`CVE-2022-20695`	8.6	10.0	0.1977	2022-04-15
`CVE-2025-13390`	8.0	10.0	0.0456	2025-12-03
`CVE-2018-4841`	7.9	9.8	0.0473	2018-03-29
`CVE-2024-4985`	7.7	9.8	0.0257	2024-05-20
`CVE-2025-21311`	7.7	9.8	0.0223	2025-01-14
`CVE-2023-3326`	7.5	9.8	0.0110	2023-06-22
`CVE-2026-29515`	7.5	9.8	0.0100	2026-03-11
`CVE-2024-10127`	7.4	9.8	0.0061	2024-11-20
`CVE-2025-66489`	7.4	9.8	0.0084	2025-12-03
`CVE-2026-35579`	7.4	9.8	0.0075	2026-05-05
`CVE-2026-46595`	7.4	10.0	0.0050	2026-05-22
`CVE-2026-46389`	7.4	10.0	0.0057	2026-06-05
`CVE-2026-59309`	7.4	9.8	0.0061	2026-07-30
`CVE-2020-8861`	7.3	8.8	0.0654	2020-02-22
`CVE-2025-63210`	7.3	9.8	0.0055	2025-11-19
`CVE-2022-39366`	7.2	9.9	0.0093	2022-10-28
`CVE-2026-28446`	7.2	9.4	0.0102	2026-03-05
`CVE-2026-77244`	7.2	10.0	0.0029	2026-09-22
`CVE-2020-15632`	7.1	8.8	0.0332	2020-07-23
`CVE-2023-29129`	7.0	9.1	0.0089	2023-06-13
`CVE-2026-33557`	7.0	9.1	0.0093	2026-04-20
`CVE-2026-41103`	7.0	9.1	0.0080	2026-05-12