COMMON WEAKNESS ENUMERATIONIncomplete

CWE-302

Authentication Bypass by Assumed-Immutable Data

The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.

Abstraction

Base

Structure

Simple

Likelihood of Exploit

Medium

Understand the problem

What is the problem?

The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.

Root cause

How and when does the problem arise?

Lifecycle phase

Architecture and Design

COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.

Lifecycle phase

Implementation

Risk

What does successful exploitation lead to?

Bypass Protection Mechanism

Affected security scopes: Access Control

Defence

How is it prevented and fixed?

Architecture and Design · Operation · Implementation

Defence to apply across several lifecycle phases

Detail
Implement proper protection for immutable data (e.g. environment variable, hidden form fields, etc.)