CWE-304 is a product that implements an authentication technique but skips a step that weakens it. MITRE's point is that authentication should follow the defining algorithm exactly. Otherwise it can be bypassed or made easier to brute force.
How it happens
Protocols have steps for reasons. A step might verify a shared secret, check a response against a challenge, or require an initial setup stage. Code that omits one still seems to work in normal use, because honest clients follow the steps anyway. Only an attacker finds out that the check is missing.
MITRE's observed examples:
- CVE-2004-2163: a shared secret is not verified in a RADIUS response packet, allowing authentication bypass by spoofing server replies.
- CVE-2005-3327: a chain in which authentication is bypassed by skipping the first startup step required by the protocol.
Both are cases where the server trusted a message without confirming the thing that made the message trustworthy.
What an attacker gains
The weakness can expose resources or functionality to unintended actors. MITRE lists impacts on access control, integrity and confidentiality: bypassing protection mechanisms, gaining the identity of another user, reading application data and, in some cases, executing unauthorized code or commands.
How to find it
MITRE says static analysis (SAST) can find some instances by modeling data flow in source or compiled code. Add protocol-level tests too: start the exchange out of order, omit a message, send a response with a missing or wrong authenticator, and confirm each attempt is refused.
How to fix it
- Write down the full sequence from the specification and map each step to code.
- Make later steps depend on a recorded result of earlier ones, so a client cannot jump ahead.
- Verify every field that carries proof, including shared-secret checks on responses.
- Fail closed on any missing or malformed step.
Quick check
Why do normal clients never notice the missing step?
They perform it anyway. The gap only matters to someone who deliberately leaves it out.
