CWE-287

Class Abstraction Level
Pillar — Highest-level weakness category
Class — Abstract, language-independent
Base — Specific enough to detect
Variant — Tied to specific technology
Compound — Requires multiple weaknesses Draft MITRE CWE Status
Stable — Fully reviewed and complete
Draft — Under development, may change
Incomplete — Partially defined by MITRE
Deprecated — No longer recommended
Obsolete — Replaced by another CWE Exploit: High
Improper Authentication

Description

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Top Monitored CVEs

CVE-2023-35078
CRITICAL KEV
9.8 100.0%
2023-07-25
CVE-2023-35082
CRITICAL KEV
9.8 100.0%
2023-08-15
CVE-2024-7593
CRITICAL KEV
9.8 100.0%
2024-08-13
CVE-2023-46805
HIGH KEV
8.2 100.0%
2024-01-12
CVE-2022-40684
CRITICAL KEV
9.8 100.0%
2022-10-18
CVE-2020-0688
HIGH KEV
8.8 100.0%
2020-02-11
CVE-2021-39226
HIGH KEV
7.3 99.9%
2021-10-05
CVE-2025-49706
MEDIUM KEV
6.5 99.9%
2025-07-08
CVE-2021-33044
CRITICAL KEV
9.8 99.9%
2021-09-15
CVE-2025-61882
CRITICAL KEV
9.8 99.7%
2025-10-05

Consequences

Integrity, Confidentiality, Availability, Access Control — Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands

This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.

Mitigations

Phase: Architecture and Design

Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

Detection

Automated Static Analysis

Automated static analysis is useful for detecting certain types of authentication. A tool may be able to analyze related configuration files, such as .htaccess in Apache web servers, or detect the usage of commonly-used authentication libraries. Generally, automated static analysis tools have difficulty detecting custom authentication schemes. In addition, the software's design may include some functionality that is accessible to any user and does not require an established identity; an automated technique that detects the absence of authentication may report false positives.

Manual Static Analysis

This weakness can be detected using tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. Manual static analysis is useful for evaluating the correctness of custom authentication mechanisms.

Manual Static Analysis - Binary or Bytecode

According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies

Dynamic Analysis with Automated Results Interpretation

According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Web Application Scanner Web Services Scanner Database Scanners

Dynamic Analysis with Manual Results Interpretation

According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Fuzz Tester Framework-based Fuzzer

Manual Static Analysis - Source Code

According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Manual Source Code Review (not inspections)

Automated Static Analysis - Source Code

According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer

Automated Static Analysis

According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: Configuration Checker

Architecture or Design Review

According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.) Formal Methods / Correct-By-Construction