OWASP Top Ten 2025 Category A07:2025 - Authentication Failures

Opis

Weaknesses in this category are related to the A07 category "Authentication Failures" in the OWASP Top Ten 2025.

Wpisy w tej grupie

• CWE-1390 Weak Authentication
• CWE-1391 Use of Weak Credentials
• CWE-1392 Use of Default Credentials
• CWE-1393 Use of Default Password
• CWE-258 Empty Password in Configuration File
• CWE-259 Use of Hard-coded Password
• CWE-287 Improper Authentication
• CWE-288 Authentication Bypass Using an Alternate Path or Channel
• CWE-289 Authentication Bypass by Alternate Name
• CWE-290 Authentication Bypass by Spoofing
• CWE-291 Reliance on IP Address for Authentication
• CWE-293 Using Referer Field for Authentication
• CWE-294 Authentication Bypass by Capture-replay
• CWE-295 Improper Certificate Validation
• CWE-297 Improper Validation of Certificate with Host Mismatch
• CWE-298 Improper Validation of Certificate Expiration
• CWE-299 Improper Check for Certificate Revocation
• CWE-300 Channel Accessible by Non-Endpoint
• CWE-302 Authentication Bypass by Assumed-Immutable Data
• CWE-303 Incorrect Implementation of Authentication Algorithm
• CWE-304 Missing Critical Step in Authentication
• CWE-305 Authentication Bypass by Primary Weakness
• CWE-306 Missing Authentication for Critical Function
• CWE-307 Improper Restriction of Excessive Authentication Attempts
• CWE-308 Use of Single-factor Authentication
• CWE-309 Use of Password System for Primary Authentication
• CWE-346 Origin Validation Error
• CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action
• CWE-384 Session Fixation
• CWE-521 Weak Password Requirements
• CWE-613 Insufficient Session Expiration
• CWE-620 Unverified Password Change
• CWE-640 Weak Password Recovery Mechanism for Forgotten Password
• CWE-798 Use of Hard-coded Credentials
• CWE-940 Improper Verification of Source of a Communication Channel
• CWE-941 Incorrectly Specified Destination in a Communication Channel

Uwagi

As of CWE 4.19, the relationships in this category were pulled directly from the CWE mappings cited in the 2025 OWASP Top Ten. These mappings include categories, which are discouraged for mapping, as well as high-level weaknesses such as Pillars. The CWE Program will work with OWASP to improve these mappings, possibly requiring modifications to CWE itself.

Źródła