CWEweakness
CWE-302 Authentication Bypass by Assumed-Immutable Data
- Abstraction
- Base
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
Common consequences
• Access Control: Bypass Protection Mechanism
Potential mitigations
• [Architecture and Design, Operation, Implementation] Implement proper protection for immutable data (e.g. environment variable, hidden form fields, etc.)
Observed examples
• CVE-2002-0367: DebPloit
• CVE-2004-0261: Web auth
• CVE-2002-1730: Authentication bypass by setting certain cookies to "true".
• CVE-2002-1734: Authentication bypass by setting certain cookies to "true".
• CVE-2002-2064: Admin access by setting a cookie.
• CVE-2002-2054: Gain privileges by setting cookie.
• CVE-2004-1611: Product trusts authentication information in cookie.
• CVE-2005-1708: Authentication bypass by setting admin-testing variable to true.
• CVE-2005-1787: Bypass auth and gain privileges by setting a variable.
Related
Attack pattern · CAPEC (8)
- CAPEC-10 Buffer Overflow via Environment Variables attack pattern
- CAPEC-13 Subverting Environment Variable Values attack pattern
- CAPEC-21 Exploitation of Trusted Identifiers attack pattern
- CAPEC-274 HTTP Verb Tampering attack pattern
- CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies attack pattern
- CAPEC-39 Manipulating Opaque Client-based Data Tokens attack pattern
- CAPEC-45 Buffer Overflow via Symbolic Links attack pattern
- CAPEC-77 Manipulating User-Controlled Variables attack pattern
Observed example · CVE (9)
- CVE-2005-1787 setup.php in phpStat 1.5 allows remote attackers to bypass authentication and gain administrator privileges by setting the $check variable. vulnerability
- CVE-2005-1708 templates.admin.users.user_form_processing in Blue Coat Reporter before 7.1.2 allows authenticated users to gain administrator privileges… vulnerability
- CVE-2004-0261 oj.cgi in OpenJournal 2.0 through 2.0.5 allows remote attackers to bypass authentication and access the control panel via a 0 in the uid… vulnerability
- CVE-2004-1611 SalesLogix 6.1 does not verify if a user is authenticated before performing sensitive operations, which could allow remote attackers to (1)… vulnerability
- CVE-2002-1730 ASPjar Guestbook 1.00 allows remote attackers to delete arbitrary messages accessing the delete.asp administrative script with certain… vulnerability
- CVE-2002-1734 NewsPro 1.01 allows remote attackers to gain unauthorized administrator access by setting their authentication cookie to "logged,true". vulnerability
- CVE-2002-2054 TeeKai Forum 1.2 allows remote attackers to authenticate as the administrator and and gain privileged web forum access by setting the… vulnerability
- CVE-2002-2064 isadmin.php in PhpWebGallery 1.0 allows remote attackers to gain administrative access via by setting the photo_login cookie to pseudo. vulnerability
- CVE-2002-0367 smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which… vulnerability
Child of · CWE (2)
Referenced by CAPEC · weakness (8)
- CAPEC-10 Buffer Overflow via Environment Variables attack pattern
- CAPEC-13 Subverting Environment Variable Values attack pattern
- CAPEC-21 Exploitation of Trusted Identifiers attack pattern
- CAPEC-274 HTTP Verb Tampering attack pattern
- CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies attack pattern
- CAPEC-39 Manipulating Opaque Client-based Data Tokens attack pattern
- CAPEC-45 Buffer Overflow via Symbolic Links attack pattern
- CAPEC-77 Manipulating User-Controlled Variables attack pattern
Referenced by CVE · weakness (46)
- CVE-2026-80092 Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a… vulnerability
- CVE-2026-84731 An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element… vulnerability
- CVE-2026-61682 kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. vulnerability
- CVE-2026-77508 Weblate is a web based localization tool. vulnerability
- CVE-2026-13267 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access… vulnerability
- CVE-2026-5423 @neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through… vulnerability
- CVE-2026-47303 Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. vulnerability
- CVE-2026-50528 Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network. vulnerability
- CVE-2026-48117 DroneAware is a drone detection platform. vulnerability
- CVE-2026-48781 Postiz is an AI social media scheduling tool. vulnerability
- CVE-2026-34460 NamelessMC is website software for Minecraft servers. vulnerability
- CVE-2025-43992 Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an authentication bypass by… vulnerability
- CVE-2026-28510 eLabFTW is an open source electronic lab notebook. vulnerability
- CVE-2026-40285 WeGIA is a web manager for charitable institutions. vulnerability
- CVE-2026-39429 kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. vulnerability
- CVE-2026-27840 ZITADEL is an open source identity management platform. vulnerability
- CVE-2024-45370 An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0. vulnerability
- CVE-2025-63210 The Newtec Celox UHD (models: CELOXA504, CELOXA820) running firmware version celox-21.6.13 is vulnerable to an authentication bypass. vulnerability
- CVE-2025-8855 Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by… vulnerability
- CVE-2025-47158 Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network. vulnerability
- CVE-2025-20285 A vulnerability in the IP Access Restriction feature of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to bypass… vulnerability
- CVE-2025-46647 A vulnerability of plugin openid-connect in Apache APISIX. vulnerability
- CVE-2025-29813 Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network. vulnerability
- CVE-2025-26522 This vulnerability exists in RupeeWeb trading platform due to improper implementation of OTP validation mechanism in certain API endpoints. vulnerability
- CVE-2025-24876 The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. vulnerability
- CVE-2024-56404 In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference (IDOR) vulnerability allows privilege escalation. vulnerability
- CVE-2024-12838 The passwordless login mechanism in CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability, allowing remote… vulnerability
- CVE-2024-43441 Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. vulnerability
- CVE-2024-8475 Authentication Bypass by Assumed-Immutable Data vulnerability in Digital Operation Services WiFiBurada allows Manipulating User-Controlled… vulnerability
- CVE-2024-49056 Authentication bypass by assumed-immutable data on airlift.microsoft.com allows an authorized attacker to elevate privileges over a network. vulnerability