CWE-304
AllowedMissing Critical Step in Authentication
Abstraction: Base · Status: Draft
The product implements an authentication technique, but it skips a step that weakens the technique.
69 vulnerabilities reference this CWE, most recent first.
GHSA-3JRW-G6MQ-CX56
Vulnerability from github – Published: 2025-07-08 15:32 – Updated: 2025-07-08 15:32A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, and before 7.0.16 & FortiProxy version 7.6.0 through 7.6.1, 7.4.0 through 7.4.8, 7.2.0 through 7.2.13 and before 7.0.20 allows an API-user using api-key + PKI user certificate authentication to login even if the certificate is invalid.
{
"affected": [],
"aliases": [
"CVE-2024-52965"
],
"database_specific": {
"cwe_ids": [
"CWE-304"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-08T15:15:22Z",
"severity": "HIGH"
},
"details": "A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, and before 7.0.16 \u0026 FortiProxy version 7.6.0 through 7.6.1, 7.4.0 through 7.4.8, 7.2.0 through 7.2.13 and before 7.0.20 allows an API-user using api-key + PKI user certificate authentication to login even if the certificate is invalid.",
"id": "GHSA-3jrw-g6mq-cx56",
"modified": "2025-07-08T15:32:03Z",
"published": "2025-07-08T15:32:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52965"
},
{
"type": "WEB",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-511"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3VXM-73WH-V829
Vulnerability from github – Published: 2025-08-07 17:34 – Updated: 2025-08-07 17:34LinkJoin through 882f196 mishandles token ownership in password reset.
{
"affected": [],
"aliases": [
"CVE-2025-55138"
],
"database_specific": {
"cwe_ids": [
"CWE-304"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-07T17:15:30Z",
"severity": "HIGH"
},
"details": "LinkJoin through 882f196 mishandles token ownership in password reset.",
"id": "GHSA-3vxm-73wh-v829",
"modified": "2025-08-07T17:34:43Z",
"published": "2025-08-07T17:34:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55138"
},
{
"type": "WEB",
"url": "https://github.com/Latkecrszy/linkjoin/pull/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4M6J-23P2-8C54
Vulnerability from github – Published: 2024-02-26 20:04 – Updated: 2024-02-26 20:04Impact
The SAML implementation provided by armeria-saml currently accepts unsigned SAML messages (assertions, logout requests, etc.) as they are, rather than rejecting them by default. As a result, an attacker can forge a SAML message to authenticate themselves, despite the fact that such an unsigned SAML message should be rejected.
Patches
The vulnerability has been patched in Armeria version 1.27.2. All users who rely on armeria-saml older than version 1.27.2 must upgrade to 1.27.2 or later.
Workarounds
There is no known workaround for this vulnerability.
References
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.27.1"
},
"package": {
"ecosystem": "Maven",
"name": "com.linecorp.armeria:armeria-saml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.27.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-1735"
],
"database_specific": {
"cwe_ids": [
"CWE-304"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-26T20:04:37Z",
"nvd_published_at": "2024-02-26T16:27:53Z",
"severity": "CRITICAL"
},
"details": "### Impact\n\nThe SAML implementation provided by `armeria-saml` currently accepts unsigned SAML messages (assertions, logout requests, etc.) as they are, rather than rejecting them by default. As a result, an attacker can forge a SAML message to authenticate themselves, despite the fact that such an unsigned SAML message should be rejected.\n\n### Patches\n\nThe vulnerability has been patched in Armeria version 1.27.2. All users who rely on `armeria-saml` older than version 1.27.2 must upgrade to 1.27.2 or later.\n\n### Workarounds\n\nThere is no known workaround for this vulnerability.\n\n### References\n\n[`SamlMessageUtil.validateSignature()`](https://github.com/line/armeria/blob/0efc776988d71be4da6e506ec8a33c2b7b43f567/saml/src/main/java/com/linecorp/armeria/server/saml/SamlMessageUtil.java#L160-L163)",
"id": "GHSA-4m6j-23p2-8c54",
"modified": "2024-02-26T20:04:37Z",
"published": "2024-02-26T20:04:37Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/line/armeria/security/advisories/GHSA-4m6j-23p2-8c54"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1735"
},
{
"type": "WEB",
"url": "https://github.com/line/armeria/commit/b2aa9f49b46a7b0e03d8b8d753809cd1e8e2016c"
},
{
"type": "PACKAGE",
"url": "https://github.com/line/armeria"
},
{
"type": "WEB",
"url": "https://github.com/line/armeria/blob/0efc776988d71be4da6e506ec8a33c2b7b43f567/saml/src/main/java/com/linecorp/armeria/server/saml/SamlMessageUtil.java#L160-L163"
},
{
"type": "WEB",
"url": "https://github.com/line/armeria/releases/tag/armeria-1.27.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Armeria SAML authentication bypass due to missing validation on unsigned SAML messages"
}
GHSA-4P5R-3JMM-652Q
Vulnerability from github – Published: 2025-09-15 21:30 – Updated: 2025-09-15 23:59Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time password (TOTP) to be used multiple times during the validity period, which allows attackers with access to a user’s TOTP to authenticate as the user.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay:com.liferay.multi.factor.authentication.timebased.otp.web"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.25"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-43798"
],
"database_specific": {
"cwe_ids": [
"CWE-304"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-15T23:59:59Z",
"nvd_published_at": "2025-09-15T21:15:35Z",
"severity": "LOW"
},
"details": "Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time password (TOTP) to be used multiple times during the validity period, which allows attackers with access to a user\u2019s TOTP to authenticate as the user.",
"id": "GHSA-4p5r-3jmm-652q",
"modified": "2025-09-15T23:59:59Z",
"published": "2025-09-15T21:30:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43798"
},
{
"type": "WEB",
"url": "https://github.com/liferay/liferay-portal/commit/1df25e46675afe7c3a2754bf8968bcb9677db950"
},
{
"type": "PACKAGE",
"url": "https://github.com/liferay/liferay-portal"
},
{
"type": "WEB",
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43798"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Liferay DXP Missing Critical Step in Authentication"
}
GHSA-5565-9R8P-CJCG
Vulnerability from github – Published: 2025-08-20 15:31 – Updated: 2025-11-03 21:34An unsafe default authentication vulnerability exists in the Initial Setup Authentication functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted network request can lead to arbitrary code execution. An attacker can browse to the device to trigger this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2025-24322"
],
"database_specific": {
"cwe_ids": [
"CWE-304"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-20T14:15:42Z",
"severity": "HIGH"
},
"details": "An unsafe default authentication vulnerability exists in the Initial Setup Authentication functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted network request can lead to arbitrary code execution. An attacker can browse to the device to trigger this vulnerability.",
"id": "GHSA-5565-9r8p-cjcg",
"modified": "2025-11-03T21:34:22Z",
"published": "2025-08-20T15:31:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24322"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2163"
},
{
"type": "WEB",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2163"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5GJG-JGH4-GPPM
Vulnerability from github – Published: 2021-06-23 17:26 – Updated: 2026-01-23 22:35Impact
Depending on implementation, a denial-of-service or privilege escalation vulnerability may occur in software that uses the github.com/ecnepsnai/web package with Web Sockets that have an AuthenticateMethod.
The AuthenticateMethod is not called, and UserData will be nil in request methods. Attempts to read the UserData may result in a panic.
This issue only affects web sockets where an AuthenticateMethod is supplied to the handle options. Users who do not use web sockets, or users who do not require authentication are not at risk.
Example
In the example below, one would expect that the AuthenticateMethod function would be called for each request to /example
handleOptions := web.HandleOptions{
AuthenticateMethod: func(request *http.Request) interface{} {
// Assume there is logic here to check for an active sessions, look at cookies or headers, etc...
var session Session{} // Example
return session
},
}
server.Socket("/example", handle, handleOptions)
However, the method is not called, and therefor the UserData parameter of the request object in the handle will be nil, when it would have been expected to be the session object we returned.
Patches
Release v1.5.2 fixes this vulnerability. The authenticate method is now called for websocket requests.
All users of the web package should update to v1.5.2 or later.
Workarounds
You may work around this issue by making the authenticate method a named function, then calling that function at the start of the handle method for the websocket. Reject connections when the return value of the method is nil.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/ecnepsnai/web"
},
"ranges": [
{
"events": [
{
"introduced": "1.4.0"
},
{
"fixed": "1.5.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-4236"
],
"database_specific": {
"cwe_ids": [
"CWE-304",
"CWE-400",
"CWE-476"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-21T17:41:20Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "### Impact\n\nDepending on implementation, a denial-of-service or privilege escalation vulnerability may occur in software that uses the `github.com/ecnepsnai/web` package with Web Sockets that have an AuthenticateMethod.\n\nThe `AuthenticateMethod` is not called, and `UserData` will be nil in request methods. Attempts to read the `UserData` may result in a panic.\n\nThis issue only affects web sockets where an `AuthenticateMethod` is supplied to the handle options. Users who do not use web sockets, or users who do not require authentication are not at risk.\n\n#### Example\n\nIn the example below, one would expect that the `AuthenticateMethod` function would be called for each request to `/example`\n\n```go\nhandleOptions := web.HandleOptions{\n\tAuthenticateMethod: func(request *http.Request) interface{} {\n\t\t// Assume there is logic here to check for an active sessions, look at cookies or headers, etc...\n\t\tvar session Session{} // Example\n\n\t\treturn session\n\t},\n}\n\nserver.Socket(\"/example\", handle, handleOptions)\n```\n\nHowever, the method is not called, and therefor the `UserData` parameter of the request object in the handle will be nil, when it would have been expected to be the `session` object we returned.\n\n### Patches\n\nRelease v1.5.2 fixes this vulnerability. The authenticate method is now called for websocket requests.\n\nAll users of the web package should update to v1.5.2 or later.\n\n### Workarounds\n\nYou may work around this issue by making the authenticate method a named function, then calling that function at the start of the handle method for the websocket. Reject connections when the return value of the method is nil.",
"id": "GHSA-5gjg-jgh4-gppm",
"modified": "2026-01-23T22:35:54Z",
"published": "2021-06-23T17:26:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ecnepsnai/web/security/advisories/GHSA-5gjg-jgh4-gppm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4236"
},
{
"type": "WEB",
"url": "https://github.com/ecnepsnai/web/commit/5a78f8d5c41ce60dcf9f61aaf47a7a8dc3e0002f"
},
{
"type": "PACKAGE",
"url": "https://github.com/ecnepsnai/web"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2021-0107"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Websocket requests did not call AuthenticateMethod"
}
GHSA-6W2C-F4VG-J9HV
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-20 12:32A missing authentication check in the uninstall endpoint of parisneo/lollms-webui V13 allows attackers to perform unauthorized directory deletions. The /uninstall/{app_name} API endpoint does not call the check_access() function to verify the client_id, enabling attackers to delete directories without proper authentication.
{
"affected": [],
"aliases": [
"CVE-2024-9919"
],
"database_specific": {
"cwe_ids": [
"CWE-304",
"CWE-306"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-20T10:15:50Z",
"severity": "HIGH"
},
"details": "A missing authentication check in the uninstall endpoint of parisneo/lollms-webui V13 allows attackers to perform unauthorized directory deletions. The /uninstall/{app_name} API endpoint does not call the check_access() function to verify the client_id, enabling attackers to delete directories without proper authentication.",
"id": "GHSA-6w2c-f4vg-j9hv",
"modified": "2025-03-20T12:32:51Z",
"published": "2025-03-20T12:32:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9919"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/5c00f56b-32a8-4e26-a4e3-de64f139da6b"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-76Q6-GFMM-Q894
Vulnerability from github – Published: 2025-03-19 09:30 – Updated: 2026-06-01 15:30Missing Critical Step in Authentication vulnerability in Elfatek Elektronics ANKA JPD-00028 allows Authentication Bypass.This issue affects ANKA JPD-00028: through 19.03.2025.
NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.
{
"affected": [],
"aliases": [
"CVE-2024-12136"
],
"database_specific": {
"cwe_ids": [
"CWE-304"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-19T09:15:12Z",
"severity": "MODERATE"
},
"details": "Missing Critical Step in Authentication vulnerability in Elfatek Elektronics ANKA JPD-00028 allows Authentication Bypass.This issue affects ANKA JPD-00028: through 19.03.2025.\n\nNOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.",
"id": "GHSA-76q6-gfmm-q894",
"modified": "2026-06-01T15:30:32Z",
"published": "2025-03-19T09:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12136"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0071"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-25-0071"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7895-GFFQ-W6JQ
Vulnerability from github – Published: 2026-06-29 21:32 – Updated: 2026-06-30 15:30Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.
{
"affected": [],
"aliases": [
"CVE-2026-55957"
],
"database_specific": {
"cwe_ids": [
"CWE-304"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-29T21:16:45Z",
"severity": "HIGH"
},
"details": "Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.",
"id": "GHSA-7895-gffq-w6jq",
"modified": "2026-06-30T15:30:43Z",
"published": "2026-06-29T21:32:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55957"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/7fk339o5jvd4mcgsf0chbrn4o525ccjh"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/06/29/26"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-7GWG-2MR3-XHPM
Vulnerability from github – Published: 2025-04-17 18:31 – Updated: 2025-04-23 18:30In JetBrains Toolbox App before 2.6 the SSH plugin established connections without sufficient user confirmation
{
"affected": [],
"aliases": [
"CVE-2025-43014"
],
"database_specific": {
"cwe_ids": [
"CWE-304"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-17T16:16:00Z",
"severity": "MODERATE"
},
"details": "In JetBrains Toolbox App before 2.6 the SSH plugin established connections without sufficient user confirmation",
"id": "GHSA-7gwg-2mr3-xhpm",
"modified": "2025-04-23T18:30:56Z",
"published": "2025-04-17T18:31:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43014"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.