Chained flaws are multiple weaknesses that combine into a stronger attack path than any single flaw would create on its own. One bug may only expose a small foothold, while another weak control turns that foothold into authentication bypass, privilege escalation, or access to sensitive systems.
This matters because defenders often fix issues one at a time and underestimate how attackers connect them. A public support portal, a login flow, and a recovery process may each seem acceptable in isolation, but together they can form a route into employee accounts or internal tools. In practice, chained flaws show up when attackers use a low-severity web bug to reach a login weakness, then pivot into sessions, admin panels, or code repositories. Defense requires reviewing the full attack path: tighten alternate authentication routes, enforce phishing-resistant sign-in, limit session lifetime, and log every high-value transition so one weak link cannot be turned into a complete compromise.