Weaknesses of type CWE-308
14 resultsAutenticação de fator único
A aplicação depende apenas de uma forma de verificação de identidade (tipicamente senha) para conceder acesso, sem camadas adicionais como segundo fator. Isso deixa contas vulneráveis se a senha for comprometida por phishing, vazamento ou força bruta, já que não há barreira extra.
Example
Um sistema bancário que exige apenas CPF e senha no login. Se um atacante obtém a senha por phishing, consegue acesso imediato à conta sem precisar passar por autenticação via SMS, token ou biometria.
How to mitigate
Implemente autenticação multifator (2FA) obrigatória — SMS, TOTP, chaves de segurança ou push notifications. Para contas críticas (admin, financeiro), exija sempre um segundo fator independente da senha.
CVE-2023-49075HIGHPimcore Admin UI has Two Factor Authentication disabled for non admin security firewallsEPSS 1.4%CVE-2023-25681MEDIUMIBM Spectrum Virtualize security bypassEPSS 0.6%CVE-2026-56022MEDIUMWebmin MFA bypassEPSS 0.5%CVE-2025-42959HIGHMissing Authentication check after implementation of SAP Security Note 3007182 and 3537476EPSS 0.5%CVE-2023-50934MEDIUMIBM PowerSC improper authenticationEPSS 0.4%CVE-2024-47652HIGHInsecure Authentication VulnerabilityEPSS 0.4%CVE-2023-34228MEDIUMIn JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actionsEPSS 0.4%CVE-2025-64103HIGHZitadel Bypass Second Authentication FactorEPSS 0.3%CVE-2026-67611HIGHOpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART ConfigurationEPSS 0.3%CVE-2026-15616CRITICALLocal MFA not enforced during SSO sign-inEPSS 0.3%CVE-2026-45749HIGHTermix's TOTP two-factor authentication can be disabled or bypassed using only the account passwordEPSS 0.3%CVE-2024-27928MEDIUMVantage6: 2FA can be circumvented with hacked email accessEPSS 0.3%CVE-2024-50618MEDIUMA Use of Single-factor Authentication vulnerability in the Authentication component of CIPPlanner CIPAce before 9.17 allows attackers to bypEPSS 0.2%CVE-2026-33550LOWSOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommEPSS 0.1%