What CVEs are caused by CWE-304?

33 recorded CVEs are attributed to CWE-304, including CVE-2025-24322, CVE-2024-8954, CVE-2024-45764.

Is CWE-304 actively exploited?

33 recorded CVEs are caused by CWE-304; none are currently in CISA's KEV catalog of actively exploited flaws.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Base weakness

Draft

CWE-304: Missing Critical Step in Authentication

Q: How is CWE-304 detected?

Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Q: What are the consequences of CWE-304?

Exploiting CWE-304 can lead to: Bypass Protection Mechanism, Gain Privileges or Assume Identity, Read Application Data, Execute Unauthorized Code or Commands.

The product implements an authentication technique, but it skips a step that weakens the technique.

Last updated May 1, 2026

33

Recorded CVEs

With this primary weakness

0

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Base

Abstraction

MITRE classification

Overview

Authentication techniques should follow the algorithms that define them exactly, otherwise authentication can be bypassed or more easily subjected to brute force attacks.

Real-world CVEs

33 recorded CVEs are caused by CWE-304 (Missing Critical Step in Authentication). The highest-severity and most recent are shown first. 6 new CWE-304 CVEs have been recorded so far in 2026 (12 in 2025).

CVE-2024-2172

Malware Scanner <= 4.7.2 and Web Application Firewall <= 2.1.1 - Unauthenticated Privilege Escalation

Critical · CVSS 9.8 · EPSS 75th

2024-03-13

CVE-2022-2302

Critical · CVSS 9.8 · EPSS 77th

2022-07-11

CVE-2011-3172

unix2_chkpwd do not check for a valid account

Critical · CVSS 9.8 · EPSS 60th

2018-06-08

CVE-2026-44547

ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2

Critical · CVSS 9.6 · EPSS 11th

2026-05-12

CVE-2024-12048

High · CVSS 8.8 · EPSS 48th

2025-03-20

CVE-2022-40622

High · CVSS 8.8 · EPSS 49th

2022-09-13

CVE-2022-1065

Multi Factor Authentication Bypass in various versions of Abacus ERP

High · CVSS 8.8 · EPSS 85th

2022-04-19

CVE-2019-16766

2FA bypass in Wagtail through new device path

High · CVSS 8.8 · EPSS 64th

2019-11-29

CVE-2026-42452

Termix: Pending-TOTP temporary token can regenerate backup codes and neutralize TOTP

High · CVSS 8.1 · EPSS 23th

2026-05-08

Showing 12 of 33 recorded CWE-304 CVEs. Track new ones as they are published and get AI-written analysis and fixes.

Monitor CWE-304 vulnerabilities

Common consequences

What can happen when CWE-304 is exploited.

Bypass Protection Mechanism, Gain Privileges or Assume Identity, Read Application Data, Execute Unauthorized Code or Commands

Affects: Access Control, Integrity, Confidentiality

This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or allowing attackers to execute arbitrary code.

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Implementation

How to detect it

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Effectiveness: High

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2004-2163 — Shared secret not verified in a RADIUS response packet, allowing authentication bypass by spoofing server replies.
CVE-2005-3327 — Chain: Authentication bypass by skipping the first startup step as required by the protocol.

Terminology & mappings

Mapped taxonomies

PLOVER: Missing Critical Step in Authentication

Frequently asked questions

Common questions about CWE-304.

What is CWE-304?: The product implements an authentication technique, but it skips a step that weakens the technique.
What CVEs are caused by CWE-304?: 33 recorded CVEs are attributed to CWE-304, including CVE-2025-24322, CVE-2024-8954, CVE-2024-45764.
How is CWE-304 detected?: Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
What are the consequences of CWE-304?: Exploiting CWE-304 can lead to: Bypass Protection Mechanism, Gain Privileges or Assume Identity, Read Application Data, Execute Unauthorized Code or Commands.
Is CWE-304 actively exploited?: 33 recorded CVEs are caused by CWE-304; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-304

Get alerted the moment a new CWE-304 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing