Security Resilience

CWE · MITRE source

CWE-304Missing Critical Step in Authentication

Abstraction: Base · CVEs in our corpus: 47

The product implements an authentication technique, but it skips a step that weakens the technique.

Authentication techniques should follow the algorithms that define them exactly, otherwise authentication can be bypassed or more easily subjected to brute force attacks.

Last updated: 15 October 2026 14:21 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 3 mapping(s) from 2 framework(s): STIG rhel 7 2 (mostly) · STIG ubuntu 22 04 1 (mostly)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A07:2025 Authentication Failures.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • IA-8 Identification and Authentication (Non-organizational Users)
  • PR.AA-02
  • PR.AA-03
  • IA-2 Identification and Authentication (Organizational Users)
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)
  • 6 hardening rules · 2 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V7.2.4

NIST 800-53 r5 controls PROPOSED for this weakness (1)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control Title Family Why it addresses this CWE
IA-8Identification and Authentication (Non-organizational Users)IAgraded full Ensures the authentication process is followed for non-organizational users, avoiding missing critical steps.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2023-543917.89.80.03062026-09-01
CVE-2022-2302 7.79.80.02142022-07-11
CVE-2024-2172 7.69.80.01712024-03-13
CVE-2024-8954 7.59.80.00892025-03-20
CVE-2026-30831 7.49.80.00632026-03-06
CVE-2026-614667.09.10.00712026-08-06
CVE-2026-59564 6.99.10.00532026-08-24
CVE-2026-44547 6.89.60.00362026-05-12
CVE-2026-940526.89.10.00382026-09-30
CVE-2022-40622 6.78.80.00742022-09-13
CVE-2024-12048 6.78.80.00742025-03-20
CVE-2022-1065 6.68.10.02892022-04-19
CVE-2026-673516.68.80.00562026-07-30
CVE-2026-49467 6.68.80.00622026-08-12
CVE-2019-16766 6.58.70.01462019-11-29
CVE-2024-457646.49.00.00522024-11-08
CVE-2024-9216 6.28.10.00632025-03-20
CVE-2025-24322 6.28.10.00572025-08-20
CVE-2026-559576.27.30.02852026-06-29
CVE-2022-2821 6.17.50.01382022-08-15
CVE-2026-42452 6.18.10.00402026-05-08
CVE-2026-76207 6.18.10.00462026-08-19
CVE-2026-890686.18.10.00462026-10-14
CVE-2026-939946.08.10.00322026-09-30
CVE-2024-11302 5.98.00.00232025-03-20