CWE-304— Missing Critical Step in Authentication
The product implements an authentication technique, but it skips a step that weakens the technique.— MITRE CWE catalog
55 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-304page 2 of 2
- CVE-2023-3629MEDIUMCVSS 4.3EG 6.52023-12-18
A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permi…
- CVE-2026-61143MEDIUMCVSS 6.4EG 6.42026-07-21
Vulnerability in the Oracle Communications Convergent Charging Controller product of Oracle Communications (component: Prov IF). Supported versions that are affected are 15.0.0.0.0 and 15.2.0.0.0. Difficult to exploit vulnerability allow…
- CVE-2025-5715MEDIUMCVSS 6.4EG 6.42025-06-06
A vulnerability was found in Signal App 7.41.4 on Android. It has been declared as problematic. This vulnerability affects unknown code of the component Biometric Authentication Handler. The manipulation leads to missing critical step in a…
- CVE-2025-43014MEDIUMCVSS 6.1EG 6.12025-04-17
In JetBrains Toolbox App before 2.6 the SSH plugin established connections without sufficient user confirmation
- CVE-2026-100667MEDIUMCVSS 5.3EG 5.32026-09-26
grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated() Twig function or the [authenticated] shortcode. On sites with…
Map vulnerabilities like CWE-304 to your infrastructure
EchelonGraph correlates every CVE — across CWE-304 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →