Common Weakness Enumeration

    CWE Definition / CWE-836

    CWE-836: Use of Password Hash Instead of Password for Authentication

    The product records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store.

    Published:22 Mar 2011
    Organization:MITRE
    Modified:11 Dec 2025

    Related Weakness

    CWE-1390: Weak Authentication

    CWE-602: Client-Side Enforcement of Server-Side Security