Skip to content
Insights · weakness

CWE-308: Use of Single-factor Authentication

Sources read 2026-11-06. MITRE's own page · All weakness notes · Added to CISA's list in the last seven days

What it is

From MITRE's CWE catalogue

The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.

MITRE classes it as a base-level weakness and rates the likelihood of exploit as high.

What it lets an attacker do

From MITRE's CWE catalogue

  • Bypass Protection Mechanism (affects: access control)

On CISA's exploited list

From CISA's exploited list

1 of the 107 entries CISA added from 2026-08-10 to 2026-11-07 name CWE-308, against 0 of 72 in the 90 days before. Over the whole catalogue 1 entries name it. The counts are small, so read them as a rough order, not a rate.

CISA's list is not every flaw that is exploited: it holds the ones CISA has evidence of, listed on the day it added them.

What MITRE suggests

From MITRE's CWE catalogue

These are MITRE's suggestions, quoted as it gives them. They are not a complete fix and not a substitute for reading the vendor's advisory for the product you run.

  • Architecture and Design: Use multiple independent authentication schemes, which ensures that -- if one of the methods is compromised -- the system itself is still likely safe from compromise. For this reason, if multiple schemes are possible, they should be implemented and required -- especially if they are easy to use.

Attack patterns MITRE links to it

From MITRE's CWE catalogue

Start with one piece of work.

Give us one piece of work and read access to one system. We map it and come back with what we found, what we would build and what it would take — before any commitment. You decide using our output, not our pitch.

Talk to us