IntegrityConfidentialityAvailabilityAccess Control
Impact
Read Application DataGain Privileges or Assume IdentityExecute Unauthorized Code or Commands
This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.
Mitigation Strategies
Phase
Architecture and Design
Description
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Strategy
Libraries or Frameworks
Detection Methods
Method
Manual Static Analysis - Binary or Bytecode
Description
According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies
Method
Dynamic Analysis with Automated Results Interpretation
Description
According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Web Application Scanner Web Services Scanner Database Scanners
Method
Dynamic Analysis with Manual Results Interpretation
Description
According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Fuzz Tester Framework-based Fuzzer
Method
Manual Static Analysis - Source Code
Description
According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Manual Source Code Review (not inspections)
Method
Automated Static Analysis - Source Code
Description
According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer
Method
Automated Static Analysis
Description
According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Configuration Checker
Method
Architecture or Design Review
Description
According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.) Formal Methods / Correct-By-Construction
Effectiveness
High
Code Examples & CVEs
Demonstrative Examples
The following code intends to ensure that the user is already logged in. If not, the code performs authentication with the user-provided username and password. If successful, it sets the loggedin and user cookies to "remember" that the user has already logged in. Finally, the code performs administrator tasks if the logged-in user has the "Administrator" username, as recorded in the user cookie.
Unfortunately, this code can be bypassed. The attacker can set the cookies independently so that the code does not check the username and password. The attacker could do this with an HTTP request containing headers such as:
BadPerl
my $q = new CGI; if ($q->cookie('loggedin') ne "true") { if (! AuthenticateUser($q->param('username'), $q->param('password'))) {ExitError("Error: you need to log in first");}else { # Set loggedin and user cookies.$q->cookie(-name => 'loggedin',-value => 'true'); $q->cookie(-name => 'user',-value => $q->param('username')); } } if ($q->cookie('user') eq "Administrator") {DoAdministratorTasks();}
File-sharing PHP product does not check if user is logged in during requests for PHP library files under an includes/ directory, allowing configuration changes, code execution, and other impacts.
Chat application skips validation when Central Authentication Service (CAS) is enabled, effectively removing the second factor from two-factor authentication
Python-based authentication proxy does not enforce password authentication during the initial handshake, allowing the client to bypass authentication by specifying a 'None' authentication type.
Chain: Web UI for a Python RPC framework does not use regex anchors to validate user login emails (CWE-777), potentially allowing bypass of OAuth (CWE-1390).
Chain: Python-based HTTP Proxy server uses the wrong boolean operators (CWE-480) causing an incorrect comparison (CWE-697) that identifies an authN failure if all three conditions are met instead of only one, allowing bypass of the proxy authentication (CWE-1390)
Chain: Cloud computing virtualization platform does not require authentication for upload of a tar format file (CWE-306), then uses .. path traversal sequences (CWE-23) in the file to access unexpected files, as exploited in the wild per CISA KEV.
Chain: user is not prompted for a second authentication factor (CWE-287) when changing the case of their username (CWE-178), as exploited in the wild per CISA KEV.
Additional facts reviewed against primary or authoritative security sources.
Combine analysis methods around the CWE-287 trust boundary
MITRE identifies automated static analysis, manual static analysis, binary review, dynamic analysis as applicable detection approaches. Use them to trace every primary, recovery, API, and alternate-protocol path that establishes identity, then prove credentials, authenticators, and protocol state are validated before a session becomes trusted. Require a reproducible trace from the initiating input or state transition to the unsafe behavior, record coverage gaps, and confirm suspected findings dynamically where safe; no single technique establishes complete coverage.
Treat authentication as a complete, uniform control
Use a maintained authentication framework or protocol and apply the same server-side checks to every login path. Protect credentials and authenticated pages with TLS, return generic failure messages, throttle repeated attempts, and require multifactor or fresh authentication for sensitive actions and after high-risk events. Keep privileged backend accounts out of public-facing login interfaces.
Apply lessons from CVE-2023-27351 in PaperCut NG/MF
NVD maps CVE-2023-27351 to CWE-287; an improper authentication condition in the SecurityRequestFilter class could allow a remote attacker to bypass authentication. Use the case to test security filters and route exclusions directly, verify enforcement cannot be skipped through alternate paths, and require authentication again at privileged handlers.
CWE-287 ranked #12 in the 2024 CWE Top 25 with a score of 15.15. Use this annual evidence to prioritize systemic prevention, detection coverage, and recurring-root-cause metrics across the portfolio, while retaining asset exposure, exploitability, and business impact for severity decisions on individual findings.
CWE-287 ranked #13 in the 2023 CWE Top 25 with a score of 6.39. Use this annual evidence to prioritize systemic prevention, detection coverage, and recurring-root-cause metrics across the portfolio, while retaining asset exposure, exploitability, and business impact for severity decisions on individual findings.
Attempt authentication through every alternate path
Inventory browser, API, mobile, SSO, recovery, setup, and legacy authentication paths. Test direct requests, missing or malformed credentials, replay, method changes, stale sessions, partial protocol handshakes, and trusted proxy headers. Confirm the server establishes identity only after complete verification and applies the same control to every path that creates or upgrades a session.
CWE-287: Improper Authentication is a Common Weakness Enumeration (CWE) entry maintained by MITRE. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Is CWE-287 in the CWE Top 25 Most Dangerous Software Weaknesses?+
Yes. CWE-287 ranked #12 in the CWE Top 25 for 2024, associated with 1,117 CVEs that year. The CWE Top 25 highlights the most common and impactful software weaknesses based on real-world vulnerability data.
What are the security consequences of Improper Authentication?+
If exploited, CWE-287 (Improper Authentication) it can compromise Integrity, Confidentiality, Availability and Access Control, leading to outcomes such as Read Application Data, Gain Privileges or Assume Identity and Execute Unauthorized Code or Commands.
How do you prevent or mitigate Improper Authentication?+
Recommended mitigations for CWE-287 include: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
How is Improper Authentication detected?+
CWE-287 can be detected using Manual Static Analysis - Binary or Bytecode, Dynamic Analysis with Automated Results Interpretation, Dynamic Analysis with Manual Results Interpretation, Manual Static Analysis - Source Code, Automated Static Analysis - Source Code and Automated Static Analysis. Combining automated tooling with manual review typically yields the best coverage.
Which programming languages are affected by Improper Authentication?+
CWE-287 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
What are real-world examples of Improper Authentication?+
MITRE documents real CVEs mapped to CWE-287, including CVE-2024-11680, CVE-2022-35248, CVE-2022-36436, CVE-2022-30034 and CVE-2022-29951. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
What is the difference between a CWE and a CVE?+
A CWE (Common Weakness Enumeration) like CWE-287 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.