Use of Single-factor Authentication
CWE-308
The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.
We track 14 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.2. 1 has been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Use multiple independent authentication schemes, which ensures that -- if one of the methods is compromised -- the system itself is still likely safe from compromise. For this reason, if multiple schemes are possible, they should be implemented and required -- especially if they are easy to use.
Latest Use of Single-factor Authentication vulnerabilities
- 7.1 High severity
Hyper E-Commerce Infrastructure: Use of Single-factor Authentication
Use of single-factor authentication vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - dealer integration, and Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - Stor
- 7.5 High severity
SonicWall SonicOS SSLVPN Use of Single-factor Authentication Exploited
An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor auth
- 8.3 High severity
phpMyFAQ: Use of Single-factor Authentication
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker wi
- 8.1 High severity
FileRise: Use of Single-factor Authentication
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through Aut
- 8.1 High severity
nginx-ui: Improper Authentication
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore iss
- 9.8 Critical severity
SAP NetWeaver (Message Server): Use of Single-factor Authentication
SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unaut
- 7.1 High severity
phpMyFAQ: Use of Single-factor Authentication
phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication (TOTP) disable functionality. The removeTwofactorConfig() handler (reachable via POST /api/user/remove-twofactor) verifies only that the user is logged in an
- 8.1 High severity
openemr: Use of Single-factor Authentication
OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration end
- 9.1 Critical severity
Logto: Use of Single-factor Authentication
Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.
- 8.1 High severity
Termix: Use of Single-factor Authentication
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST /users/totp/disable` and `POST /users/totp/backup-codes` endpoints in Termix prior to version 2.3.2 accept the account password as a sole au
- 9.8 Critical severity
zitadel: Improper Authentication
Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers. If a user has set up MFA without this requirement, Zitadel would consider single fact
- 8.1 High severity
SAP NetWeaver ABAP Server and ABAP Platform: Use of Single-factor Authentication
An unauthenticated attacker may exploit a scenario where a Hashed Message Authentication Code (HMAC) credential, extracted from a system missing specific security patches, is reused in a replay attack against a different system. Even if the target system is fu
- 8.1 High severity
Client Dashboard: Use of Single-factor Authentication
This vulnerability exists in Shilpi Client Dashboard due to implementation of inadequate authentication mechanism in the login module wherein access to any users account is granted with just their corresponding mobile number. A remote attacker could exploit th
- 7.2 High severity
admin-ui-classic-bundle: Use of Single-factor Authentication
The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundle\Security\PimcoreUserTwoFactorCondition` introduced in v11 disable the two factor authentication for all non-admin security firewalls. An authenticated user can access the system without h