Description
The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
This incorrect implementation may allow authentication to be bypassed.
Potential Impact
Access Control
Bypass Protection Mechanism
Real-World CVE Examples
| CVE ID | Description |
|---|---|
| CVE-2003-0750 | Conditional should have been an 'or' not an 'and'. |
Related Weaknesses
Taxonomy Mappings
- PLOVER: — Authentication Logic Error
Frequently Asked Questions
What is CWE-303?
CWE-303 (Incorrect Implementation of Authentication Algorithm) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
How can CWE-303 be exploited?
Attackers can exploit CWE-303 (Incorrect Implementation of Authentication Algorithm) to bypass protection mechanism. This weakness is typically introduced during the Implementation phase of software development.
How do I prevent CWE-303?
Follow secure coding practices, conduct code reviews, and use automated security testing tools (SAST/DAST) to detect this weakness early in the development lifecycle.
What is the severity of CWE-303?
CWE-303 is classified as a Base-level weakness (Medium abstraction). It has been observed in 1 real-world CVEs.