CWE-1390: Weak Authentication | Glexia
CWE-1390 (Weak Authentication) weakness overview with consequences, detection methods, mitigations, related CVEs and MITRE ATT&CK context.
Glexia's Take · Automated analysis
CWE-1390: Weak Authentication
Weak Authentication represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Executive Impact
- Integrity Confidentiality Availability Access Control: Read Application Data Gain Privileges or Assume Identity Execute Unauthorized Code or Commands: This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.
Developer Pattern
CWE-1390 is the kind of defect developers can usually prevent with explicit validation, safer framework defaults, and tests that exercise hostile input or unsafe state transitions.
Automation confidence
high confidence from CWE-1390, 4.20.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Official CWE Definition
CWE-1390: Weak Authentication
The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.
Attackers may be able to bypass weak authentication faster and/or with less effort than expected.
Developer And Remediation Guidance
How teams prevent and detect this weakness
Causes
- In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications. Multiple OT products used weak authentication.
Remediation
- Use safe APIs
- Centralize the control
- Add regression tests
- Review logs and telemetry for attempted abuse
Detection
- Code review
- SAST
- DAST
- Focused regression tests
Mappings
Related CVEs, CWEs, and ATT&CK context
Related CWEs
- CWE-287: Improper Authentication
- CWE-1391: Use of Weak Credentials
- CWE-262: Not Using Password Aging
- CWE-263: Password Aging with Long Expiration
- CWE-289: Authentication Bypass by Alternate Name
- CWE-290: Authentication Bypass by Spoofing
- CWE-294: Authentication Bypass by Capture-replay
- CWE-301: Reflection Attack in an Authentication Protocol
- CWE-302: Authentication Bypass by Assumed-Immutable Data
- CWE-303: Incorrect Implementation of Authentication Algorithm
- CWE-305: Authentication Bypass by Primary Weakness
- CWE-307: Improper Restriction of Excessive Authentication Attempts
ATT&CK Relevance
ATT&CK relevance is shown only when reviewed or responsibly inferred.