CWE-1254: Incorrect Comparison Logic Granularity
The product's comparison logic is performed over a series of steps rather than across the entire string in one operation. If there is a comparison logic failure on one of these steps, the operation may be vulnerable to a timing attack that can result in the interception of the process for nefarious purposes.
Last updated
Overview
Comparison logic is used to compare a variety of objects including passwords, Message Authentication Codes (MACs), and responses to verification challenges. When comparison logic is implemented at a finer granularity (e.g., byte-by-byte comparison) and breaks in the case of a comparison failure, an attacker can exploit this implementation to identify when exactly the failure occurred. With multiple attempts, the attacker may be able to guesses the correct password/response to challenge and elevate their privileges.
Real-world CVEs
5 recorded CVEs are caused by CWE-1254 (Incorrect Comparison Logic Granularity). The highest-severity and most recent are shown first. 4 new CWE-1254 CVEs have been recorded so far in 2026 (1 in 2025).
- CVE-2026-34572
CI4MS: Account Deactivation Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)
High · CVSS 8.8 · EPSS 39th2026-04-01 - CVE-2026-34570
CI4MS: Account Deletion Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)
High · CVSS 8.8 · EPSS 39th2026-04-01