The product has a protection mechanism that is too difficult or inconvenient to use, encouraging non-malicious users to disable or bypass the mechanism, whether by accident or on purpose.

Primary

Architecture and Design

Access Control
Bypass Protection Mechanism
By bypassing the security mechanism, a user might leave the system in a less secure state than intended by the administrator, making it more susceptible to compromise.

Testing
Where possible, perform human factors and usability studies to identify where your product's security mechanisms are difficult to use, and why.

Architecture and Design
Make the security mechanism as seamless as possible, while also providing the user with sufficient details when a security decision produces unexpected results.

In "Usability of Security: A Case Study" [REF-540], the authors consider human factors in a cryptography product. Some of the weakness relevant discoveries of this case study were: users accidentally leaked sensitive information, could not figure out how to perform some tasks, thought they were enabling a security option when they were not, and made improper trust decisions.

Enforcing complex and difficult-to-remember passwords that need to be frequently changed for access to trivial resources, e.g., to use a black-and-white printer. Complex password requirements can also cause users to store the passwords in an unsafe manner so they don't have to remember them, such as using a sticky note or saving them in an unencrypted file.

Some CAPTCHA utilities produce images that are too difficult for a human to read, causing user frustration.

Part 2-1
Req 4.3.3.6

Part 4-1
Req SD-4

Allowed-with-Review
This CWE entry is a Class, but it does not have Base-level children.
This entry is classified in a part of CWE's hierarchy that does not have sufficiently low-level coverage, which might reflect a lack of classification-oriented weakness research in the software security community. Conduct careful root cause analysis to determine the original mistake that led to this weakness. If closer analysis reveals that this weakness is appropriate, then this might be the best available CWE to use for mapping. If no other option is available, then it is acceptable to map to this CWE.

This weakness covers many security measures causing user inconvenience, requiring effort or causing frustration, that are disproportionate to the risks or value of the protected assets, or that are perceived to be ineffective.

Pascal Meunier
Purdue University
2008-01-18
Draft 8
2008-01-30

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Common_Consequences, Relationships, Other_Notes, Weakness_Ordinalities

CWE Content Team
MITRE
2009-01-12
updated Description, Name

CWE Content Team
MITRE
2009-05-27
updated Name

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated References, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-06-23
updated Demonstrative_Examples

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Causal_Nature

CWE Content Team
MITRE
2020-02-24
updated Relationships, Time_of_Introduction

CWE Content Team
MITRE
2022-04-28
updated Relationships

CWE Content Team
MITRE
2022-10-13
updated References

CWE Content Team
MITRE
2023-01-31
updated Description, Maintenance_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2023-04-27
updated References, Relationships, Time_of_Introduction, Type

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-04-03
4.17
2025-04-03
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Maintenance_Notes

Nicolai Plum
2022-07-16
Provided new links for a reference that improved multiple CWEs.

"Mapping CWE to 62443" Sub-Working Group
CWE-CAPEC ICS/OT SIG
2023-01-24
4.10
2023-01-31
Suggested mappings to ISA/IEC 62443.

Design Principle Violation: Failure to Satisfy Psychological Acceptability
Failure to Satisfy Psychological Acceptability