The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
View on MITREImplement proper protection for immutable data (e.g. environment variable, hidden form fields, etc.)
No detection method information available for this CWE.
In the following example, an "authenticated" cookie is used to determine whether or not a user should be granted access to a system.
Modifying the value of a cookie on the client-side is trivial, but many developers assume that cookies are essentially immutable.
CWE-302: Authentication Bypass by Assumed-Immutable Data is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
If exploited, CWE-302 (Authentication Bypass by Assumed-Immutable Data) it can compromise Access Control, leading to outcomes such as Bypass Protection Mechanism.
Recommended mitigations for CWE-302 include: Implement proper protection for immutable data (e.g. environment variable, hidden form fields, etc.)
CWE-302 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
MITRE documents real CVEs mapped to CWE-302, including CVE-2002-0367, CVE-2004-0261, CVE-2002-1730, CVE-2002-1734 and CVE-2002-2064. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
A CWE (Common Weakness Enumeration) like CWE-302 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.