| CWE-287 | Improper Authentication | 4,507 | 40 | 93 |
| CWE-306 | Missing Authentication | 3,466 | 46 | 104 |
| CWE-798 | Hard-coded Credentials | 1,594 | 9 | 23 |
| CWE-522 | Insufficiently Protected Credentials | 1,215 | 5 | 8 |
| CWE-290 | Authentication Bypass by Spoofing | 822 | 8 | 7 |
| CWE-288 | Authentication Bypass Using an Alternate Path or Channel | 749 | 20 | 24 |
| CWE-255 | Credentials Management Errors | 705 | 0 | 2 |
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | 695 | 0 | 2 |
| CWE-613 | CWE-613 | 652 | 0 | 0 |
| CWE-384 | Session Fixation | 429 | 1 | 3 |
| CWE-640 | Weak Password Recovery Mechanism for Forgotten Password | 313 | 1 | 5 |
| CWE-294 | Authentication Bypass by Capture-replay | 302 | 0 | 0 |
| CWE-521 | Weak Password Requirements | 241 | – | – |
| CWE-259 | Use of Hard-coded Password | 229 | – | – |
| CWE-256 | Plaintext Storage of a Password | 228 | – | – |
| CWE-305 | Authentication Bypass by Primary Weakness | 176 | – | – |
| CWE-1392 | Use of Default Credentials | 131 | – | – |
| CWE-1390 | Weak Authentication | 129 | – | – |
| CWE-303 | Incorrect Implementation of Authentication Algorithm | 114 | – | – |
| CWE-620 | Unverified Password Change | 104 | – | – |
| CWE-257 | Storing Passwords in a Recoverable Format | 68 | – | – |
| CWE-1391 | Use of Weak Credentials | 56 | – | – |
| CWE-304 | Missing Critical Step in Authentication | 54 | – | – |
| CWE-289 | Authentication Bypass by Alternate Name | 46 | – | – |
| CWE-261 | Weak Encoding for Password | 44 | – | – |
| CWE-1393 | Use of Default Password | 44 | – | – |
| CWE-302 | Authentication Bypass by Assumed-Immutable Data | 39 | – | – |
| CWE-350 | Reliance on Reverse DNS Resolution for a Security-Critical Action | 30 | – | – |
| CWE-603 | Use of Client-Side Authentication | 27 | – | – |
| CWE-1394 | Use of Default Cryptographic Key | 27 | – | – |
| CWE-523 | Unprotected Transport of Credentials | 25 | – | – |
| CWE-260 | Password in Configuration File | 24 | – | – |
| CWE-308 | Use of Single-factor Authentication | 23 | – | – |
| CWE-592 | CWE-592 | 21 | – | – |
| CWE-549 | Missing Password Field Masking | 16 | – | – |
| CWE-836 | Use of Password Hash Instead of Password for Authentication | 16 | – | – |
| CWE-258 | Empty Password in Configuration File | 14 | – | – |
| CWE-1299 | Missing Protection Mechanism for Alternate Hardware Interface | 13 | – | – |
| CWE-291 | Reliance on IP Address for Authentication | 12 | – | – |
| CWE-645 | Overly Restrictive Account Lockout Mechanism | 10 | – | – |
| CWE-262 | Not Using Password Aging | 6 | – | – |
| CWE-309 | Use of Password System for Primary Authentication | 2 | – | – |
| CWE-555 | J2EE Misconfiguration: Plaintext Password in Configuration File | 2 | – | – |
| CWE-263 | Password Aging with Long Expiration | 1 | – | – |
| CWE-293 | Using Referer Field for Authentication | 1 | – | – |
| CWE-301 | Reflection Attack in an Authentication Protocol | 1 | – | – |