What MITRE says

The description above is MITRE’s definition of CWE-328 in CWE 4.20, a base-level weakness.

Common consequences MITRE lists

  • Access Control: Bypass Protection Mechanism

Guides on this site

Cites this weakness · Reference

Hash collisions and digital signatures: MD5, SHA-1 and what to use

Distinguish collisions from preimages, follow a colliding pair through signing and verification, and retire MD5 and SHA-1 from the verifiers that still accept them.

Cites this weakness · Case study

Flame: MD5 certificate forgery

Follow how a weak digest and an overpowered certificate trust path enabled forged code-signing authority, without equating the event with RSA key theft.

Cites this weakness · Guide

Tokenization, pseudonymization and privacy transformations: choose deliberately

Choose between vault tokens, keyed pseudonyms, format-preserving encryption, aggregation and differential privacy by the joins, reversibility and leakage each allows, and test re-identification on the data you release.

Cites this weakness · Reference

Choose cryptographic algorithms and parameters by job

A sourced quick reference for October 2026: which algorithm and parameters to use for encryption, hashing, passwords, MACs, signatures, key agreement, key derivation, randomness and TLS, the matching APIs in Node.js, Python, Java, Go and .NET, and where post-quantum migration stands.

Practice

References

  1. CWE-328 in the MITRE CWE list (version 4.20)

This page is generated from MITRE’s CWE 4.20 catalogue (released 30 April 2026) and lists every guide, fix card and lab here that cites CWE-328.

CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.