CWE-655 covers protection mechanisms that are so difficult or inconvenient to use that non-malicious users disable or bypass them, by accident or on purpose. No attacker is needed to start the problem. The control fails because the people it was meant to protect route around it. It affects any product with security features that users must operate: login flows, permission prompts, certificate warnings, encryption tools, approval gates.
How it happens
A few familiar cases. A password policy so strict that people write passwords on sticky notes. A pull request gate so slow that engineers ask for exceptions as a habit. A certificate warning so frequent that users click through every one. An approval step that blocks urgent work, so teams create a shared account to skip it.
The mechanism is simple: when the secure path costs more effort than the insecure path, many people take the insecure one.
What an attacker gains
MITRE lists one consequence, a bypass of the protection mechanism. By bypassing it, a user may leave the system in a less secure state than the administrator intended, making it more susceptible to compromise. The attacker benefits from the gap the users created.
How to find it
The record lists no detection methods. Look for evidence of workarounds: shared accounts, disabled checks, long lists of exemptions, support tickets asking how to turn a feature off, and settings that default to off because the on state was too noisy.
How to fix it
MITRE's mitigations:
- Where possible, run human factors and usability studies to find where security mechanisms are difficult to use, and why.
- Make the security mechanism as frictionless as possible, while still giving the user enough detail when a security decision produces unexpected results.
Watch the workaround rate as a metric. If many people bypass a control, treat that as a defect in the control, not in the people.
Quick check
Who is the adversary in this weakness?
Often nobody at first. Ordinary users disable or bypass a hard-to-use control, and that leaves the system exposed.
