Skip to content
OpenAdvisories

Weakness (CWE)

CWE-304: Missing Critical Step in Authentication

Base Draft

The product implements an authentication technique, but it skips a step that weakens the technique.

Source: MITRE CWE-304

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2023-54391 Public exploit

    Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter

    Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by sup…

    Proxmox Server Solutions Proxmox Virtual Environment (VE) Virtualization
  • High 7.3
    CVE-2026-55957 Public exploit

    Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

    Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven