cve.bz

CWE-309: Use of Password System for Primary Authentication

Filter

The use of password systems as the primary means of authentication may be subject to several flaws or shortcomings, each reducing the effectiveness of the mechanism.

What the weakness is: CWE-309 at MITRE. OWASP Top 10: A07:2025 Authentication Failures

Related attack patterns (CAPEC): 12
  • CAPEC-16 Dictionary-based Password Attack Likelihood: Medium · Severity: High
  • CAPEC-49 Password Brute Forcing Likelihood: Medium · Severity: High
  • CAPEC-55 Rainbow Table Password Cracking Likelihood: Medium · Severity: Medium
  • CAPEC-70 Try Common or Default Usernames and Passwords Likelihood: Medium · Severity: High
  • CAPEC-509 Kerberoasting Severity: High
  • CAPEC-555 Remote Services with Stolen Credentials Severity: Very High
  • CAPEC-560 Use of Known Domain Credentials Likelihood: High · Severity: High
  • CAPEC-561 Windows Admin Shares with Stolen Credentials
  • CAPEC-565 Password Spraying Likelihood: High · Severity: High
  • CAPEC-600 Credential Stuffing Likelihood: High · Severity: High
  • CAPEC-652 Use of Known Kerberos Credentials Likelihood: Medium · Severity: High
  • CAPEC-653 Use of Known Operating System Credentials Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-309, as MITRE names them. Credits.

Ask an AI about CWE-309

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-309: Use of Password System for Primary Authentication and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/309.html and https://cve.bz/cve/cwe/309?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2026-44300EPSS 0.8%

    OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and sub…

  2. 7.8CVE-2024-45675EPSS 0.1%

    IBM Informix Dynamic Server 14.10 could allow a local user on the system to log into the Informix server as administrator without a password.