CWE-302 — Authentication Bypass by Assumed-Immutable Data
CWE-302: Authentication Bypass by Assumed-Immutable Data
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Base |
| Status | Incomplete |
| Likelihood of exploit | — |
Description
The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
Common consequences
- Access Control: Bypass Protection Mechanism
Mitigations
Architecture and Design — Implement proper protection for immutable data (e.g. environment variable, hidden form fields, etc.)
References
- CWE page: https://cwe.mitre.org/data/definitions/302.html
- CWE list: https://cwe.mitre.org/data/index.html
See all 1,245 pages under Weakness classes (CWE) →
Related pages
Browse by topic
Every page in the corpus, grouped. Search finds one page; this shows what else is here.