CWEweakness

CWE-603 Use of Client-Side Authentication

Official page ↗
Abstraction
Base
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.

Common consequences

• Access Control: Bypass Protection Mechanism, Gain Privileges or Assume Identity — Client-side authentication is extremely weak and may be breached easily. An attacker may read the source code or otherwise reverse-engineer the authentication mechanism, then modify the client or otherwise to access parts of the application that would otherwise be protected.

Potential mitigations

• [Architecture and Design] Do not rely on client side data. Always perform server side authentication.

Observed examples

• CVE-2022-33139: SCADA system only uses client-side authentication, allowing adversaries to impersonate other users. • CVE-2006-0230: Client-side check for a password allows access to a server using crafted XML requests from a modified client.

Related

Observed example · CVE (2)

  • CVE-2022-33139 A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC… vulnerability
  • CVE-2006-0230 Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses a client-side check to verify a password, which allows… vulnerability

Child of · CWE (2)

  • CWE-1390 Weak Authentication weakness
  • CWE-602 Client-Side Enforcement of Server-Side Security weakness

Peer of · CWE (2)

  • CWE-300 Channel Accessible by Non-Endpoint weakness
  • CWE-656 Reliance on Security Through Obscurity weakness

Referenced by CVE · weakness (27)

  • CVE-2026-90983 Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. vulnerability
  • CVE-2026-3096 The product's web portals allow external links to be opened in a new browser tab. vulnerability
  • CVE-2026-66305 Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network. vulnerability
  • CVE-2026-71187 The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. vulnerability
  • CVE-2026-76945 The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. vulnerability
  • CVE-2026-42098 Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role. vulnerability
  • CVE-2026-8830 A flaw was found in Keycloak. vulnerability
  • CVE-2026-40551 Multiple BinSoft products perform client-side authentication. vulnerability
  • CVE-2025-30042 The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in… vulnerability
  • CVE-2026-1363 IAQS and I6 developed by JNC has a Client-Side Enforcement of Server-Side Security vulnerability, allowing unauthenticated remote attackers… vulnerability
  • CVE-2025-64119 A vulnerability in Nuvation Battery Management System allows Authentication Bypass.This issue affects Battery Management System: through… vulnerability
  • CVE-2025-61940 NMIS/BioDose V22.02 and previous versions rely on a common SQL Server user account to access data in the database. vulnerability
  • CVE-2025-12868 New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to… vulnerability
  • CVE-2025-62649 The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for submission of… vulnerability
  • CVE-2025-62650 The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for use of the… vulnerability
  • CVE-2025-24517 Use of client-side authentication issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. vulnerability
  • CVE-2024-52327 The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access… vulnerability
  • CVE-2024-45785 MUSASI version 3 contains an issue with use of client-side authentication. vulnerability
  • CVE-2024-39375 TELSAT marKoni FM Transmitters are vulnerable to an attacker bypassing authentication and gaining administrator privileges. vulnerability
  • CVE-2024-28627 An issue in Flipsnack v.18/03/2024 allows a local attacker to obtain sensitive information via the reader.gz.js file. vulnerability
  • CVE-2022-3218 Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially… vulnerability
  • CVE-2022-33139 A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC… vulnerability
  • CVE-2021-43355 Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 allows user input to be validated on the client side without… vulnerability
  • CVE-2020-27266 In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its… vulnerability
  • CVE-2020-7591 A vulnerability has been identified in SIPORT MP (All versions < 3.2.1). vulnerability
  • CVE-2020-6988 Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all… vulnerability
  • CVE-2017-7909 A Use of Client-Side Authentication issue was discovered in Advantech B+B SmartWorx MESR901 firmware versions 1.5.2 and prior. vulnerability