CWE-308 applies when a product uses an authentication method with a single factor, such as a password, in a security context that should require more than one.
The key words are "should require more." A forum login may be fine with a password. An admin console, a payment approval or a remote management interface is a different matter.
How it happens
Single-factor design is usually the default, not a decision. Teams ship a password login because it is quick, and nobody revisits it when the thing it protects grows in value.
It also appears in a quieter form: a second factor exists but can be skipped. MITRE's observed example is CVE-2022-35248, where a chat application skipped validation when Central Authentication Service (CAS) was enabled, which effectively removed the second factor from two-factor authentication. The product claimed two factors and delivered one.
What an attacker gains
If the secret in a single-factor scheme is compromised, full authentication is possible. MITRE lists this as a bypass of a protection mechanism. Passwords leak through phishing, reuse across sites, malware and weak storage, so this is not a rare event.
How to find it
The record lists no detection methods. A design review is the right tool:
- List every login surface and ask what a stolen password alone would allow.
- Pay special attention to administrative, remote access and high-value actions.
- Test each alternate login path, such as single sign-on, API keys and recovery flows, to confirm each enforces the same factors.
How to fix it
MITRE's advice is to use multiple independent authentication schemes, so that if one is compromised the system is still likely safe. If several schemes are possible, implement them and require them, especially when they are easy to use.
- Require a second factor for privileged and sensitive operations.
- Make the factors independent, so one theft or one breach does not yield both.
- Enforce the second factor on every path, including federated login and recovery.
- Test the paths with deliberate bypass attempts, as the CAS case shows.
Quick check
Does a long password count as two factors?
No. Length makes guessing harder, but it is still one factor. If it leaks, access is complete.
