CWE-308Use of Single-factor Authentication

Abstraction: Base · CVEs in our corpus: 14

The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.

Last updated: 20 August 2026 13:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 20 mapping(s) from 2 framework(s): CAPEC 13 (partial) · ATT&CK 7 (mostly)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A07:2025 Authentication Failures.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.AA-03
IA-2 Identification and Authentication (Organizational Users)
IA-8 Identification and Authentication (Non-organizational Users)

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

V6.3.4
V6.3.6
V6.4.2
V6.4.3

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1021 Remote Services←P →M T1021.002 SMB/Windows Admin Shares→P T1078.001 Default Accounts←P →M T1110.002 Password Cracking←M →M T1114.002 Remote Email Collection←P →M T1133 External Remote Services←P →M T1550.002 Pass the Hash←P →M T1558 Steal or Forge Kerberos Tickets→P T1558.003 Kerberoasting←P →M

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2025-64103`	7.2	9.8	0.0033	2025-10-29
`CVE-2026-15616`	6.8	9.1	0.0033	2026-07-23
`CVE-2023-49075`	6.2	8.4	0.0144	2023-11-28
`CVE-2024-47652`	6.1	8.1	0.0041	2024-10-04
`CVE-2025-42959`	6.1	8.1	0.0050	2025-07-08
`CVE-2026-45749`	6.0	8.1	0.0032	2026-06-05
`CVE-2026-67611`	6.0	8.1	0.0033	2026-08-03
`CVE-2023-50934`	4.5	5.3	0.0044	2024-02-02
`CVE-2026-56022`	4.5	5.3	0.0056	2026-06-18
`CVE-2023-25681`	4.3	5.3	0.0056	2024-03-05
`CVE-2023-34228`	4.2	5.3	0.0040	2023-05-31
`CVE-2024-50618`	3.6	4.3	0.0024	2026-02-11
`CVE-2026-33550`	1.8	2.0	0.0014	2026-03-22