{
  "slug": "missing-multi-factor-authentication",
  "url": "https://library.infinity8labs.com/missing-multi-factor-authentication/",
  "title": "Missing multi-factor authentication",
  "short": "Missing MFA",
  "aliases": [
    "Single-factor authentication",
    "MFA not enforced",
    "Two-factor authentication missing"
  ],
  "summary": "Missing MFA leaves an account protected by only one factor, commonly a reusable password. A stolen, phished, sprayed, or reused password can therefore provide immediate access.",
  "cwe": [
    "CWE-308"
  ],
  "owasp": "A07:2021 Identification and Authentication Failures",
  "typical_severity": {
    "min": "medium",
    "max": "critical"
  },
  "updated": "2026-10-15",
  "references": [
    {
      "title": "CWE-308: Use of Single-factor Authentication",
      "url": "https://cwe.mitre.org/data/definitions/308.html"
    },
    {
      "title": "NIST SP 800-63B: Authentication and Authenticator Management",
      "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
    },
    {
      "title": "OWASP Multifactor Authentication Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat_Sheet.html"
    },
    {
      "title": "OWASP Authentication Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html"
    },
    {
      "title": "OWASP Top 10 A07:2021 Identification and Authentication Failures",
      "url": "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/"
    }
  ],
  "sections": [
    "https://library.infinity8labs.com/missing-multi-factor-authentication/#overview",
    "https://library.infinity8labs.com/missing-multi-factor-authentication/#impact",
    "https://library.infinity8labs.com/missing-multi-factor-authentication/#examples",
    "https://library.infinity8labs.com/missing-multi-factor-authentication/#remediation",
    "https://library.infinity8labs.com/missing-multi-factor-authentication/#testing",
    "https://library.infinity8labs.com/missing-multi-factor-authentication/#references"
  ]
}