CWE-304— Missing Critical Step in Authentication
The product implements an authentication technique, but it skips a step that weakens the technique.— MITRE CWE catalog
60 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-304page 2 of 2
- CVE-2024-7745MEDIUMCVSS 6.5EG 6.52024-08-28
In WS_FTP Server versions before 8.8.8 (2022.0.8), a Missing Critical Step in Multi-Factor Authentication of the Web Transfer Module allows users to skip the second-factor verification and log in with username and password only.
- CVE-2023-3628MEDIUMCVSS 6.5EG 6.52023-12-18
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
- CVE-2022-39360MEDIUMCVSS 6.5EG 6.52022-10-26
Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 single sign on (SSO) users were able to do password resets on Metabase, which could allow a user access without g…
- CVE-2021-41179MEDIUMCVSS 6.5EG 6.52021-10-25
Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Factor Authentication wasn't enforced for pages marked as public. Any page marked as `@PublicPage` coul…
- CVE-2023-3629MEDIUMCVSS 4.3EG 6.52023-12-18
A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permi…
- CVE-2026-61143MEDIUMCVSS 6.4EG 6.42026-07-21
Vulnerability in the Oracle Communications Convergent Charging Controller product of Oracle Communications (component: Prov IF). Supported versions that are affected are 15.0.0.0.0 and 15.2.0.0.0. Difficult to exploit vulnerability allow…
- CVE-2025-5715MEDIUMCVSS 6.4EG 6.42025-06-06
A vulnerability was found in Signal App 7.41.4 on Android. It has been declared as problematic. This vulnerability affects unknown code of the component Biometric Authentication Handler. The manipulation leads to missing critical step in a…
- CVE-2026-119776MEDIUMCVSS 6.1EG 6.12026-11-04
In all prior released versions of FRRouting, the OSPFv3 (for IPv6) implementation does not check that OSPFv3 packets have a link-local source address and either a link-local destination or one of the protocol multicast destination groups. …
- CVE-2025-43014MEDIUMCVSS 6.1EG 6.12025-04-17
In JetBrains Toolbox App before 2.6 the SSH plugin established connections without sufficient user confirmation
- CVE-2026-100667MEDIUMCVSS 5.3EG 5.32026-09-26
grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated() Twig function or the [authenticated] shortcode. On sites with…
Map vulnerabilities like CWE-304 to your infrastructure
EchelonGraph correlates every CVE — across CWE-304 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →