The product implements an authentication technique, but it skips a step that weakens the technique.
View on MITREAuthentication techniques should follow the algorithms that define them exactly, otherwise authentication can be bypassed or more easily subjected to brute force attacks.
This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or allowing attackers to execute arbitrary code.
No mitigation information available for this CWE.
No detection method information available for this CWE.
Shared secret not verified in a RADIUS response packet, allowing authentication bypass by spoofing server replies.
View DetailsChain: Authentication bypass by skipping the first startup step as required by the protocol.
View DetailsCWE-304: Missing Critical Step in Authentication is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product implements an authentication technique, but it skips a step that weakens the technique. Authentication techniques should follow the algorithms that define them exactly, otherwise authentication can be bypassed or more easily subjected to brute force attacks.
If exploited, CWE-304 (Missing Critical Step in Authentication) it can compromise Access Control, Integrity and Confidentiality, leading to outcomes such as Bypass Protection Mechanism, Gain Privileges or Assume Identity, Read Application Data and Execute Unauthorized Code or Commands.
CWE-304 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
MITRE documents real CVEs mapped to CWE-304, including CVE-2004-2163 and CVE-2005-3327. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
A CWE (Common Weakness Enumeration) like CWE-304 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.