Description

The software implements an authentication technique, but it skips a step that weakens the technique.

Extended Description

Authentication techniques should follow the algorithms that define them exactly, otherwise authentication can be bypassed or more easily subjected to brute force attacks.

Applicable Platforms
Language Class: All

Time Of Introduction

• Architecture and Design
• Implementation

Common Consequences

Detection Methods
None

Potential Mitigations
None

Relationships

Demonstrative Examples
None

Observed Examples

1. CVE-2004-2163 : Shared secret not verified in a RADIUS response packet, allowing authentication bypass by spoofing server replies.

White Box Definitions
None

Black Box Definitions
None

Taxynomy Mappings

References:
None