CWE-636: Not Failing Securely ('Failing Open')
Also known as: Failing Open
When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
Last updated
Overview
By entering a less secure state, the product inherits the weaknesses associated with that state, making it easier to compromise. At the least, it causes administrators to have a false sense of security. This weakness typically occurs as a result of wanting to "fail functional" to minimize administration and support costs, instead of "failing safe."
Real-world CVEs
52 recorded CVEs are caused by CWE-636 (Not Failing Securely ('Failing Open')). The highest-severity and most recent are shown first. 41 new CWE-636 CVEs have been recorded so far in 2026 (2 in 2025).
- CVE-2024-3729
Frontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handling to Form Manipulation
Critical · CVSS 9.8 · EPSS 56th2024-05-02 - CVE-2026-103510
Authentication bypass via blank auth token in P4Search
Critical · CVSS 9.5 · EPSS 27th2026-10-05 - CVE-2026-95848
Moquette fails open when configured authentication or authorization classes cannot load
Critical · CVSS 9.3 · EPSS 35th2026-09-23 - CVE-2026-53459
Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints
Critical · CVSS 9.3 · EPSS 54th2026-09-15 - CVE-2026-22034
Snuffleupagus vulnerable to RCE on instances with upload validation enabled but without the VLD package
Critical · CVSS 9.2 · EPSS 53th2026-01-08 - CVE-2026-40525
OpenViking < 0.3.9 Authentication Bypass via VikingBot OpenAPI
Critical · CVSS 9.1 · EPSS 54th2026-04-17 - CVE-2026-18329
NGINX ngx_http_js_module vulnerability
High · CVSS 8.8 · EPSS 30th2026-09-02 - CVE-2024-43532
Remote Registry Service Elevation of Privilege Vulnerability
High · CVSS 8.8 · EPSS 96th2024-10-08 - CVE-2021-1578High · CVSS 8.8 · EPSS 80th2021-08-25
- CVE-2026-40248
free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions
High · CVSS 8.7 · EPSS 42th2026-04-16 - CVE-2026-40247
free5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions
High · CVSS 8.7 · EPSS 42th2026-04-16 - CVE-2025-54870
VTun-ng's failure to initialize encryption modules may cause reversion to plaintext
High · CVSS 8.7 · EPSS 9th2025-08-05
Showing 12 of 52 recorded CWE-636 CVEs. Get an alert for each new one, with AI-written analysis and fixes.
Monitor CWE-636 vulnerabilitiesCommon consequences
What can happen when CWE-636 is exploited.
Bypass Protection Mechanism
Affects: Access Control
Intended access restrictions can be bypassed, which is often contradictory to what the product's administrator expects.
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Applies to
Technologies
How to prevent it
Practical mitigations for CWE-636, grouped by where in the lifecycle they apply.
Subdivide and allocate resources and components so that a failure in one part does not affect the entire product.
Code examples
MITRE examples of the weakness in code.
Switches may revert their functionality to that of hubs when the table used to map ARP information to the switch interface overflows, such as when under a spoofing attack. This results in traffic being broadcast to an eavesdropper, instead of being sent only on the relevant switch interface. To mitigate this type of problem, the developer could limit the number of ARP entries that can be recorded for a given switch interface, while other interfaces may keep functioning normally. Configuration options can be provided on the appropriate actions to be taken in case of a detected failure, but safe defaults should be used.
Illustrative examples
Real CVEs that MITRE cites as examples of this weakness.
- CVE-2007-5277 — The failure of connection attempts in a web browser resets DNS pin restrictions. An attacker can then bypass the same origin policy by rebinding a domain name to a different IP address. This was an attempt to "fail functional."
- CVE-2006-4407 — Incorrect prioritization leads to the selection of a weaker cipher. Although it is not known whether this issue occurred in implementation or design, it is feasible that a poorly designed algorithm could be a factor.
Terminology & mappings
Alternate terms
- Failing Open
Mapped taxonomies
- OWASP Top Ten 2004: Improper Error Handling (A7) — CWE More Specific fit
Frequently asked questions
Common questions about CWE-636.
- What is CWE-636?
- When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
- What CVEs are caused by CWE-636?
- 52 recorded CVEs are attributed to CWE-636, including CVE-2024-3729, CVE-2026-103510, CVE-2026-95848.
- Is CWE-636 part of the OWASP Top 10?
- CWE-636 maps to OWASP Top Ten 2004: Improper Error Handling (A7) in the OWASP security taxonomy.
- How do you prevent CWE-636?
- Subdivide and allocate resources and components so that a failure in one part does not affect the entire product.
- What are the consequences of CWE-636?
- Exploiting CWE-636 can lead to: Bypass Protection Mechanism.
- Is CWE-636 actively exploited?
- 52 recorded CVEs are caused by CWE-636; none are currently in CISA's KEV catalog of actively exploited flaws.
References
- MITRE CWE definition (CWE-636) (opens in a new tab)
- CWE-636 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Track CWE-636 CVEs
Get an alert when a new CWE-636 CVE affects your products, with AI-written analysis and remediation steps.