What CVEs are caused by CWE-836?

14 recorded CVEs are attributed to CWE-836, including CVE-2021-23857, CVE-2023-34132, CVE-2023-23450.

What are the consequences of CWE-836?

Exploiting CWE-836 can lead to: Bypass Protection Mechanism, Gain Privileges or Assume Identity.

Is CWE-836 actively exploited?

14 recorded CVEs are caused by CWE-836; none are currently in CISA's KEV catalog of actively exploited flaws.

Base weakness

Incomplete

CWE-836: Use of Password Hash Instead of Password for Authentication

The product records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store.

Last updated May 1, 2026

Recorded CVEs

With this primary weakness

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Base

Abstraction

MITRE classification

Overview

Some authentication mechanisms rely on the client to generate the hash for a password, possibly to reduce load on the server or avoid sending the password across the network. However, when the client is used to generate the hash, an attacker can bypass the authentication by obtaining a copy of the hash, e.g. by using SQL injection to compromise a database of authentication credentials, or by exploiting an information exposure. The attacker could then use a modified client to replay the stolen hash without having knowledge of the original password. As a result, the server-side comparison against a client-side hash does not provide any more security than the use of passwords without hashing.

Real-world CVEs

14 recorded CVEs are caused by CWE-836 (Use of Password Hash Instead of Password for Authentication). The highest-severity and most recent are shown first. 3 new CWE-836 CVEs have been recorded so far in 2026 (3 in 2025).

Showing 12 of 14 recorded CWE-836 CVEs. Track new ones as they are published and get AI-written analysis and fixes.

Monitor CWE-836 vulnerabilities

Common consequences

What can happen when CWE-836 is exploited.

Bypass Protection Mechanism, Gain Privileges or Assume Identity

Affects: Access Control

An attacker could bypass the authentication routine without knowing the original password.

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Implementation

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2009-1283 — Product performs authentication with user-supplied password hashes that can be obtained from a separate SQL injection vulnerability (CVE-2009-1282).
CVE-2005-3435 — Product allows attackers to bypass authentication by obtaining the password hash for another user and specifying the hash in the pwd argument.

Attack patterns

CAPEC attack patterns that exploit this weakness.

Frequently asked questions

Common questions about CWE-836.

What is CWE-836?: The product records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store.
What CVEs are caused by CWE-836?: 14 recorded CVEs are attributed to CWE-836, including CVE-2021-23857, CVE-2023-34132, CVE-2023-23450.
What are the consequences of CWE-836?: Exploiting CWE-836 can lead to: Bypass Protection Mechanism, Gain Privileges or Assume Identity.
Is CWE-836 actively exploited?: 14 recorded CVEs are caused by CWE-836; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-836

Get alerted the moment a new CWE-836 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing