CWE-305Authentication Bypass by Primary Weakness

Abstraction: Base · CVEs in our corpus: 175

The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

Last updated: 16 October 2026 00:29 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 2 mapping(s) from 2 framework(s): STIG ubuntu 22 04 1 (partial) · STIG ubuntu 24 04 1 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A07:2025 Authentication Failures.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.AA-03
PR.PS-06
ID.RA-01
AC-3 Access Enforcement

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

5 hardening rules · 3 OS baselines

Validate

Prove the fix (OWASP ASVS)

V6.4.3

NIST 800-53 r5 controls PROPOSED for this weakness (0)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2025-31161` KEV	9.9	9.8	0.9997	2025-04-03
`CVE-2026-81578` KEV	9.9	9.8	0.8558	2026-08-28
`CVE-2023-34124`	9.4	9.8	0.5048	2023-07-13
`CVE-2020-10923`	9.1	8.8	0.8468	2020-07-28
`CVE-2025-32011`	8.8	9.8	0.2873	2025-05-01
`CVE-2021-26102`	8.5	9.8	0.1973	2024-12-19
`CVE-2022-2651`	8.4	9.8	0.1575	2022-08-04
`CVE-2023-0777`	8.4	9.8	0.1521	2023-02-10
`CVE-2025-13915`	8.1	9.8	0.0901	2025-12-26
`CVE-2024-1403`	7.9	10.0	0.0330	2024-02-27
`CVE-2022-0547`	7.8	9.8	0.0357	2022-03-18
`CVE-2024-37085` KEV	7.8	6.8	0.2677	2024-06-25
`CVE-2026-25555`	7.8	9.8	0.0273	2026-06-08
`CVE-2024-20674`	7.7	8.8	0.1717	2024-01-09
`CVE-2026-30849`	7.7	9.8	0.0235	2026-03-23
`CVE-2020-15787`	7.6	9.8	0.0148	2020-09-09
`CVE-2020-24683`	7.6	9.8	0.0148	2020-12-22
`CVE-2019-14910`	7.5	9.8	0.0105	2019-12-05
`CVE-2023-1307`	7.5	9.8	0.0107	2023-03-10
`CVE-2023-34137`	7.5	9.8	0.0101	2023-07-13
`CVE-2024-1202`	7.5	9.8	0.0090	2024-03-21
`CVE-2024-50478`	7.5	9.8	0.0111	2024-10-28
`CVE-2025-24522`	7.5	10.0	0.0077	2025-05-01
`CVE-2025-46801`	7.5	9.8	0.0091	2025-05-19
`CVE-2023-1833`	7.4	9.8	0.0076	2023-04-14