CWE-308 · Authentication
Use of Single-factor Authentication
23CVEs
SortMost likely exploited
23 CVEs with CWE-308 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-19868In CISA KEVExploitedAn authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication…SonicWall · SonicOS · CVSS 7.5 · 2026-11-06 | 7.5 | 0.5% | 2026-11-06 |
| CVE-2023-49075Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewallspimcore · admin-ui-classic-bundle · CVSS 8.5 · 2023-11-28 | 8.5 | 1.4% | 2023-11-28 |
| CVE-2026-67611OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configurationopenemr · openemr · CVSS 8.1 · 2026-08-03 | 8.1 | 0.8% | 2026-08-03 |
| CVE-2025-42959Missing Authentication check after implementation of SAP Security Note 3007182 and 3537476SAP_SE · SAP NetWeaver ABAP Server and ABAP Platform · CVSS 8.1 · 2025-07-08 | 8.1 | 0.6% | 2025-07-08 |
| CVE-2023-25681IBM Spectrum Virtualize security bypassIBM · Spectrum Virtualize · CVSS 5.3 · 2024-03-05 | 5.3 | 0.6% | 2024-03-05 |
| CVE-2026-56022Webmin MFA bypassWebmin · Webmin · CVSS 5.3 · 2026-06-18 | 5.3 | 0.6% | 2026-06-18 |
| CVE-2026-15616Local MFA not enforced during SSO sign-inLogto · Logto · CVSS 9.1 · 2026-07-23 | 9.1 | 0.5% | 2026-07-23 |
| CVE-2026-58240Missing Authentication check in SAP NetWeaver (Message Server)SAP_SE · SAP NetWeaver (Message Server) · CVSS 9.8 · 2026-09-08 | 9.8 | 0.5% | 2026-09-08 |
| CVE-2026-57490FileRise: WebDAV authentication bypasses TOTP/MFA entirelyerror311 · FileRise · CVSS 8.1 · 2026-10-14 | 8.1 | 0.5% | 2026-10-14 |
| CVE-2026-85590phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disablethorsten · phpMyFAQ · CVSS 7.1 · 2026-09-04 | 7.1 | 0.5% | 2026-09-04 |
| CVE-2023-50934IBM PowerSC improper authenticationIBM · PowerSC · CVSS 5.3 · 2024-02-02 | 5.3 | 0.4% | 2024-02-02 |
| CVE-2024-47652Insecure Authentication VulnerabilityShilpi Computers · Client Dashboard · CVSS 7.6 · 2024-10-04 | 7.6 | 0.4% | 2024-10-04 |
| CVE-2023-34228In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actionsJetBrains · TeamCity · CVSS 5.3 · 2023-05-31 | 5.3 | 0.4% | 2023-05-31 |
| CVE-2025-64103Zitadel Bypass Second Authentication Factorzitadel · zitadel · CVSS 8.7 · 2025-10-29 | 8.7 | 0.4% | 2025-10-29 |
| CVE-2026-121531Umami 2FA Policy route.ts single-factor authenticationUmami · Umami · CVSS 6.3 · 2026-11-03 | 6.3 | 0.3% | 2026-11-03 |
| CVE-2026-111884phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeoverthorsten · phpMyFAQ · CVSS 8.3 · 2026-10-17 | 8.3 | 0.3% | 2026-10-17 |
| CVE-2026-45749Termix's TOTP two-factor authentication can be disabled or bypassed using only the account passwordTermix-SSH · Termix · CVSS 8.1 · 2026-06-05 | 8.1 | 0.3% | 2026-06-05 |
| CVE-2026-79763Termix: MFA-critical operations accept the account password as a sole factor (regression of CVE-2026-45749)Termix-SSH · Termix · CVSS 5.3 · 2026-09-24 | 5.3 | 0.3% | 2026-09-24 |
| CVE-2024-50618A Use of Single-factor Authentication vulnerability in the Authentication component of CIPPlanner CIPAce before 9.17 allows attackers to bypass a protection mechanism. When the sy…Cipplanner · Cipace · CVSS 4.3 · 2026-02-11 | 4.3 | 0.3% | 2026-02-11 |
| CVE-2024-27928Vantage6: 2FA can be circumvented with hacked email accessvantage6 · vantage6 · CVSS 5.9 · 2026-06-17 | 5.9 | 0.3% | 2026-06-17 |
| CVE-2026-90862Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP ServerProgress Software · WS_FTP Server · CVSS 4.3 · 2026-10-29 | 4.3 | 0.2% | 2026-10-29 |
| CVE-2026-111552Multi-Factor Authentication Bypass in Hyper Technology's Hyper E-Commerce InfrastructureHyper Teknoloji Ltd. Şti. · Hyper E-Commerce Infrastructure · CVSS 7.1 · 2026-11-12 | 7.1 | 0.2% | 2026-11-12 |
| CVE-2026-33550SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).Alinto · SOGo · CVSS 2 · 2026-03-22 | 2.0 | 0.1% | 2026-03-22 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.