cve.bz

CWE-325: Missing Cryptographic Step

Filter

The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.

What the weakness is: CWE-325 at MITRE. OWASP Top 10: A04:2025 Cryptographic Failures

Related attack patterns (CAPEC): 1
  • CAPEC-68 Subvert Code-signing Facilities Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-325, as MITRE names them. Credits.

Ask an AI about CWE-325

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-325: Missing Cryptographic Step and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/325.html and https://cve.bz/cve/cwe/325?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2026-108910EPSS 0.1%

    IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive information due to missing required cryptographic step.

  2. 8.1CVE-2026-117957EPSS 0.2%

    Cryptographic issue in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  3. 3.1CVE-2026-109839EPSS 0.5%

    IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm.

  4. 8.7CVE-2026-101294EPSS 0.2%

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptograp…

  5. 6.3CVE-2026-107785EPSS 0.1%

    Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key. When a peering session negotiates use of SHA-512, the key produced is 64 bytes instead of the 32 bytes WireGuard requires. The agent does n…

  6. 8.7CVE-2026-16000EPSS 0.2%

    Missing cryptographic step in the DSTU 7624 CCM mode implementation (KCcmBlockCipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can observe encrypted messages of known or chosen content to forge ciph…

  7. 8.1CVE-2026-100798EPSS 0.2%

    Cryptography misuse in Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

  8. 1.3CVE-2026-96552EPSS 0.2%

    A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function MD5.getMD5 of the file ssm_pro/src/main/java/cn/sfturing/utils/MD5.java of the component User Passwo…

  9. 4.9CVE-2026-81235EPSS 0.2%

    Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Cryptographic Step vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering.

  10. 6.0CVE-2026-25250EPSS 0.1%

    EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic Step" associated with "Secure Boot disable."

  11. 8.7CVE-2026-76784EPSS 0.2%

    Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol. An adjacent network attacker may intercept, replay or forge locally exchanged control messages, potentially…

  12. 9.1CVE-2026-17666EPSS 0.2%

    Cryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to bypass discretionary access control via malicious network traffic. (Chromium security severity: High)

  13. 7.0CVE-2026-59776EPSS 0.2%

    Missing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips shipped in or before 2017. If the vulnerability is exploited, information stored in the IC chip may be read or tampered with.

  14. 5.5CVE-2026-58638EPSS 0.2%

    Missing cryptographic step in Windows Boot Loader allows an authorized attacker to bypass a security feature locally.

  15. 7.1CVE-2026-55144EPSS 0.2%

    Missing cryptographic step in Windows CryptoAPI allows an authorized attacker to perform tampering locally.

  16. 5.1CVE-2026-6458EPSS 0.2%

    Missing cryptographic step in Caliptra Core Firmware (aes_256_gcm_update module) results in an incorrect GCM authentication tag. When the streaming AES-256-GCM API is used with empty AAD, the hardware GHASH accumulator state is not saved a…

  17. 7.4CVE-2026-49440EPSS 0.2%

    Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, node:crypto.checkPrime(candidate[, options][, callback]) and crypto.checkPrimeSync(candidate[, options]) ran no Miller-Rabin rounds at all when the caller left opti…

  18. 7.0CVE-2026-9266EPSS 0.07%

    A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and controllers. This vulnerability represents an incomplete remediation of CVE-2026-0714. The firmware intr…

  19. 4.8CVE-2026-45446EPSS 0.4%

    Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD (Additional Authenticated Data) with an empty ciphertext allowing a forgery of such messages. Impact summary: An attac…

  20. 7.5CVE-2026-45445EPSS 0.7%

    Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded. Impact summary: Every message encrypted under the …

  21. 3.7CVE-2026-42770EPSS 0.5%

    Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p a…

  22. 4.6CVE-2026-0420EPSS 0.1%

    An improper implementation of TLS certificate validation vulnerability found in NETGEAR's ReadyCloud client app which could allow an attacker to perform attacker-in-the-middle (MiTM) style attacks impacting the product's confidentiality. T…

  23. 6.6CVE-2026-48480EPSS 0.2%

    The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.22.FInal, the codec-ohttp implementation of draft-ietf-ohai-chunked-ohttp does not verify that a cryptographically-signed final chunk was received …

  24. 7.6CVE-2026-42246EPSS 0.3%

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without sta…

  25. 8.2CVE-2026-41395EPSS 0.1%

    OpenClaw before 2026.3.28 contains a webhook replay vulnerability in Plivo V3 signature verification that canonicalizes query ordering for signatures but hashes raw URLs for replay detection. Attackers can reorder query parameters to bypas…

  26. 7.3CVE-2026-40542EPSS 0.5%

    Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5…

  27. 6.3CVE-2026-29142EPSS 0.1%

    SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to forge a GINA-encrypted email.

  28. 8.8CVE-2026-4601EPSS 0.3%

    Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s t…

  29. 7.7CVE-2026-4258EPSS 0.3%

    Versions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey(). An attacker can recover a victim's ECDH private key by …

  30. 8.2CVE-2026-28498EPSS 0.2%

    Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Spe…

  31. 7.2CVE-2025-47383EPSS 0.1%

    Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.

  32. 4.0CVE-2025-69418EPSS 0.1%

    Issue summary: When using the low-level OCB API directly with AES-NI or<br>other hardware-accelerated code paths, inputs whose length is not a multiple<br>of 16 bytes can leave the final partial block unencrypted and unauthenticated.<br><b…

  33. 9.2CVE-2026-22863EPSS 0.2%

    Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.6.0, node:crypto doesn't finalize cipher. The vulnerability allows an attacker to have infinite encryptions. This can lead to naive attempts at brute forcing, as well as m…

  34. 7.5CVE-2025-60704EPSS 0.6%

    Missing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.

  35. 4.4CVE-2025-59339EPSS 0.1%

    The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. Session-recording ttyrec files, may be handled by the provided osh-encrypt-rsync script that is a helper to rotate, encrypt, sign, copy, an…

  36. 6.0CVE-2025-58359EPSS 0.3%

    ZF FROST is a Rust implementation of FROST (Flexible Round-Optimised Schnorr Threshold signatures). In versions 2.0.0 through 2.1.0, refresh shares with smaller min_signers will reduce security of group. The inability to change min_signers…

  37. 4.9CVE-2025-49600EPSS 0.2%

    In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid signatures if hash computation fails and internal errors go unchecked, enabling LMS (Leighton-Micali Signature) forgery in a fault scenario. Specifically, unchecked retur…

  38. 3.4CVE-2015-20112EPSS 0.2%

    RLPx 5 has two CTR streams based on the same key, IV, and nonce. This can facilitate decryption on a private network.

  39. 6.3CVE-2025-5323EPSS 0.1%

    A vulnerability, which was classified as problematic, has been found in fossasia open-event-server 1.19.1. This issue affects the function send_email_change_user_email of the file /fossasia/open-event-server/blob/development/app/api/helper…

  40. 9.8CVE-2025-3938EPSS 0.3%

    Missing Cryptographic Step vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15…

  41. 8.7CVE-2025-30147EPSS 0.3%

    Besu Native contains scripts and tooling that is used to build and package the native libraries used by the Ethereum client Hyperledger Besu. Besu 24.7.1 through 25.2.2, corresponding to besu-native versions 0.9.0 through 1.2.1, have a pot…

  42. 2.7CVE-2024-55655EPSS 0.3%

    sigstore-python is a Python tool for generating and verifying Sigstore signatures. Versions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insufficient validation of the "integration time" present in "v2" and "v3" bundles d…

  43. 6.8CVE-2022-20793EPSS 0.4%

    A vulnerability in pairing process of Cisco&nbsp;TelePresence CE Software and RoomOS Software for Cisco&nbsp;Touch 10 Devices could allow an unauthenticated, remote attacker to impersonate a legitimate device and pair with an affected devi…

  44. 5.9CVE-2024-43547EPSS 0.7%

    Windows Kerberos Information Disclosure Vulnerability

  45. 6.5CVE-2023-39199EPSS 0.6%

    Cryptographic issues with In-Meeting Chat for some Zoom clients may allow a privileged user to conduct an information disclosure via network access.

  46. 7.5CVE-2023-46129EPSS 0.4%

    NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not ju…

  47. 7.5CVE-2023-40012EPSS 0.2%

    uthenticode is a small cross-platform library for partially verifying Authenticode digital signatures. Versions of uthenticode prior to the 2.x series did not check Extended Key Usages in certificates, in violation of the Authenticode X.50…

  48. 8.1CVE-2023-34471EPSS 0.3%

    AMI SPx contains a vulnerability in the BMC where a user may cause a missing cryptographic step by generating a hash-based message authentication code (HMAC). A successful exploit of this vulnerability may lead to the loss confidentiality,…

  49. 7.5CVE-2023-36539EPSS 0.5%

    Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information.

  50. 6.4CVE-2023-28999EPSS 0.7%

    Nextcloud is an open-source productivity platform. In Nextcloud Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until 3.25.0, and Nextcloud iOS app 3.0.5 until 4.8.0, a malicious server administrator can gain full access to …