CWE-309 (使用口令系统作为基本认证机制) — Vulnerability Class 1

CWE-309 represents a critical authentication weakness where password systems serve as the sole mechanism for verifying user identity, inherently lacking the resilience of multi-factor approaches. This vulnerability is typically exploited by attackers leveraging credential stuffing, brute force attacks, or phishing schemes to harvest or guess passwords, thereby gaining unauthorized access to sensitive systems. Since passwords are susceptible to theft, reuse, and weak selection, relying exclusively on them creates a single point of failure that adversaries can easily compromise. To mitigate this risk, developers must implement multi-factor authentication (MFA) that combines something the user knows with something they have or are. By integrating hardware tokens, biometric verification, or time-based one-time passwords, organizations significantly raise the barrier for attackers, ensuring that compromised credentials alone are insufficient for unauthorized entry.