The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

Attackers may be able to bypass weak authentication faster and/or with less effort than expected.

Primary

Architecture and Design

Implementation

Integrity
Confidentiality
Availability
Access Control
Read Application Data
Gain Privileges or Assume Identity
Execute Unauthorized Code or Commands
This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.

In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications.
Multiple OT products used weak authentication.

CVE-2024-48445
Chain: e-commerce app relies on an easily-guessable timestamp (CWE-341) in a weak authentication algorithm (CWE-1390)
https://www.cve.org/CVERecord?id=CVE-2024-48445

CVE-2022-30034
Chain: Web UI for a Python RPC framework does not use regex anchors to validate user login emails (CWE-777), potentially allowing bypass of OAuth (CWE-1390).
https://www.cve.org/CVERecord?id=CVE-2022-30034

CVE-2022-35248
Chat application skips validation when Central Authentication Service
(CAS) is enabled, effectively removing the second factor from
two-factor authentication
https://www.cve.org/CVERecord?id=CVE-2022-35248

CVE-2021-3116
Chain: Python-based HTTP Proxy server uses the wrong boolean operators (CWE-480) causing an incorrect comparison (CWE-697) that identifies an authN failure if all three conditions are met instead of only one, allowing bypass of the proxy authentication (CWE-1390)
https://www.cve.org/CVERecord?id=CVE-2021-3116

CVE-2022-29965
Distributed Control System (DCS) uses a deterministic algorithm to generate utility passwords
https://www.cve.org/CVERecord?id=CVE-2022-29965

CVE-2022-29959
Initialization file contains credentials that can be decoded using a "simple string transformation"
https://www.cve.org/CVERecord?id=CVE-2022-29959

CVE-2020-8994
UART interface for AI speaker uses empty password for root shell
https://www.cve.org/CVERecord?id=CVE-2020-8994

Allowed-with-Review
This CWE entry is a Class and might have Base-level children that would be more appropriate
Examine children of this entry to see if there is a better fit

CWE Content Team
MITRE
2022-10-05
4.9
2022-10-13

CWE Content Team
MITRE
2023-01-31
updated Applicable_Platforms, Demonstrative_Examples, Observed_Examples, References, Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Observed_Examples

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Observed_Examples

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Observed_Examples, Relationships, Weakness_Ordinalities