The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.

What CVEs are caused by CWE-308?

17 recorded CVEs are attributed to CWE-308, including CVE-2026-58240, CVE-2026-15616, CVE-2026-67611.

How do you prevent CWE-308?

Use multiple independent authentication schemes, which ensures that -- if one of the methods is compromised -- the system itself is still likely safe from compromise. For this reason, if multiple schemes are possible, they should be implemented and required -- especially if they are easy to use.

What are the consequences of CWE-308?

Exploiting CWE-308 can lead to: Bypass Protection Mechanism.

Is CWE-308 actively exploited?

17 recorded CVEs are caused by CWE-308; none are currently in CISA's KEV catalog of actively exploited flaws.

CWE-308: Use of Single-factor Authentication

RadicalNotion.AI

Code examples

MITRE examples of the weakness in code.

In both of these examples, a user is logged in if their given password matches a stored password:

Vulnerable example

unsigned char *check_passwd(char *plaintext) {

Vulnerable example

java

//Login if hash matches stored hash
String plainText = new String(plainTextIn);

This code relies exclusively on a password mechanism (CWE-309) using only one factor of authentication (CWE-308). If an attacker can steal or guess a user's password, they are given full access to their account. Note this code also uses SHA-1, which is a weak hash (CWE-328). It also does not use a salt (CWE-759).

CWE-308: Use of Single-factor Authentication

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

How to prevent it

Code examples

Illustrative examples

Terminology & mappings

Mapped taxonomies

Attack patterns

Frequently asked questions

References

Track CWE-308 CVEs

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

How to prevent it

Code examples

Illustrative examples

Related weaknesses

Parent

Peer

Terminology & mappings

Mapped taxonomies

Attack patterns

Frequently asked questions

References

Track CWE-308 CVEs