A07:2025 Authentication Failures
Identity verification can be bypassed, brute-forced, or hijacked. Credential stuffing, weak password reset flows, session-management mistakes.
Member CWEs (36)
- CWE-258 Empty Password in Configuration File
- CWE-259 Use of Hard-coded Password
- CWE-287 Improper Authentication
- CWE-288 Authentication Bypass Using an Alternate Path or Channel
- CWE-289 Authentication Bypass by Alternate Name
- CWE-290 Authentication Bypass by Spoofing
- CWE-291 Reliance on IP Address for Authentication
- CWE-293 Using Referer Field for Authentication
- CWE-294 Authentication Bypass by Capture-replay
- CWE-295 Improper Certificate Validation
- CWE-297 Improper Validation of Certificate with Host Mismatch
- CWE-298 Improper Validation of Certificate Expiration
- CWE-299 Improper Check for Certificate Revocation
- CWE-300 Channel Accessible by Non-Endpoint
- CWE-302 Authentication Bypass by Assumed-Immutable Data
- CWE-303 Incorrect Implementation of Authentication Algorithm
- CWE-304 Missing Critical Step in Authentication
- CWE-305 Authentication Bypass by Primary Weakness
- CWE-306 Missing Authentication for Critical Function
- CWE-307 Improper Restriction of Excessive Authentication Attempts
- CWE-308 Use of Single-factor Authentication
- CWE-309 Use of Password System for Primary Authentication
- CWE-346 Origin Validation Error
- CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action
- CWE-384 Session Fixation
- CWE-521 Weak Password Requirements
- CWE-613 Insufficient Session Expiration
- CWE-620 Unverified Password Change
- CWE-640 Weak Password Recovery Mechanism for Forgotten Password
- CWE-798 Use of Hard-coded Credentials
- CWE-940 Improper Verification of Source of a Communication Channel
- CWE-941 Incorrectly Specified Destination in a Communication Channel
- CWE-1390 Weak Authentication
- CWE-1391 Use of Weak Credentials
- CWE-1392 Use of Default Credentials
- CWE-1393 Use of Default Password
Mapped NIST 800-53 r5 controls (70)
Our two-way, human-QA’d reading of how this category and each NIST 800-53 control relate. No external body publishes an OWASP→800-53 mapping, so these are our assessment.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
AC-12←P →PAC-17→PAC-17.1←P →PAC-17.2→PAC-18.1←PAC-2←PAC-2.5→PAC-6.9←PAC-7←MAT-3←PAU-12←PAU-2←MAU-3←PAU-6←PAU-6.1←PAU-7←MAU-7.1←PCA-2←PCA-2.1←MCA-5←MCA-7←PCA-7.1←PCA-7.4←P →PCM-4←PCM-6←PIA-11←PIA-12←MIA-12.2←PIA-12.3←PIA-12.5←PIA-13←MIA-2←PIA-2.1←MIA-2.12←PIA-2.2←MIA-2.8←PIA-3←PIA-4←PIA-5←MIA-5.2←PIA-5.6←PIA-6←PIA-7←PIA-8←MIA-8.1←PIA-8.2←PIR-3←PIR-4←PIR-4.1←PIR-5←PIR-6←PMA-4←P →PPS-4←PRA-3←PRA-5←PRA-5.11←PRA-7←PSA-11←MSA-3←PSA-4←PSA-4.10←PSA-8←PSC-13←PSC-8→PSI-2←PSI-4←MSI-4.2←PSI-4.4←PSI-4.5←PSI-7←P
Tagged CVEs (showing 50 most recent of 17,591)
- CVE-2026-111356
- CVE-2026-111329
- CVE-2026-111322
- CVE-2026-111312
- CVE-2026-111283
- CVE-2026-111281
- CVE-2026-110864
- CVE-2026-110863
- CVE-2026-110862
- CVE-2026-110861
- CVE-2026-110852
- CVE-2026-110838
- CVE-2026-110770
- CVE-2026-110768
- CVE-2026-110723
- CVE-2026-110669
- CVE-2026-110667
- CVE-2026-110632
- CVE-2026-110619
- CVE-2026-110618
- CVE-2026-110616
- CVE-2026-110130
- CVE-2026-110128
- CVE-2026-110114
- CVE-2026-110097
- CVE-2026-109969
- CVE-2026-109949
- CVE-2026-109829
- CVE-2026-109758
- CVE-2026-109575
- CVE-2026-109571
- CVE-2026-109570
- CVE-2026-109566
- CVE-2026-109506
- CVE-2026-109439
- CVE-2026-109423
- CVE-2026-109399
- CVE-2026-109383
- CVE-2026-109372
- CVE-2026-109371
- CVE-2026-109362
- CVE-2026-109342
- CVE-2026-109332
- CVE-2026-109321
- CVE-2026-109320
- CVE-2026-109313
- CVE-2026-109312
- CVE-2026-109289
- CVE-2026-109286
- CVE-2026-109245
Data: OWASP Top 10:2025 (CC BY-SA 4.0) · CWE memberships from cwe-api.mitre.org (meta-category CWE-1442).