CWE•Base•Incomplete•7 recent CVEs
CWE-302Authentication Bypass by Assumed-Immutable Data
Description
The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
Common consequences
- Access Control→Bypass Protection Mechanism
Potential mitigations
- Architecture and Design,Operation,ImplementationImplement proper protection for immutable data (e.g. environment variable, hidden form fields, etc.)