BaseIncomplete
CWE-302Authentication Bypass by Assumed-Immutable Data
Category: auth
Description
The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
Common consequences· 1
- Access Control — Bypass Protection Mechanism
Potential mitigations· 1
- [Architecture and Design, Operation, Implementation]Implement proper protection for immutable data (e.g. environment variable, hidden form fields, etc.)
Related CAPEC attack patterns· 8
References
Exploits (incoming)8
| Type | Target | Confidence | Tier |
|---|---|---|---|
| AttackPattern | Buffer Overflow via Symbolic Linkscapec-45 | 100% | live |
| AttackPattern | Exploitation of Trusted Identifierscapec-21 | 100% | live |
| AttackPattern | Buffer Overflow via Environment Variablescapec-10 | 100% | live |
| AttackPattern | Manipulating User-Controlled Variablescapec-77 | 100% | live |
| AttackPattern | HTTP Verb Tamperingcapec-274 | 100% | live |
| AttackPattern | Subverting Environment Variable Valuescapec-13 | 100% | live |
| AttackPattern | Accessing/Intercepting/Modifying HTTP Cookiescapec-31 | 100% | live |
| AttackPattern | Manipulating Opaque Client-based Data Tokenscapec-39 | 100% | live |
(incoming)7
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Vulnerability | CVE-2025-24876cve-2025-24876 | 0% | live |
| Vulnerability | CVE-2025-29813cve-2025-29813 | 0% | live |
| Vulnerability | CVE-2025-47158cve-2025-47158 | 0% | live |
| Vulnerability | CVE-2025-63210cve-2025-63210 | 0% | live |
| Vulnerability | CVE-2025-8855cve-2025-8855 | 0% | live |
| Vulnerability | CVE-2026-39429cve-2026-39429 | 0% | live |
| Vulnerability | CVE-2026-40285cve-2026-40285 | 0% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.