The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.

Resultant

Architecture and Design
COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.

Implementation

Access Control
Bypass Protection Mechanism

Architecture and Design
Operation
Implementation
Implement proper protection for immutable data (e.g. environment variable, hidden form fields, etc.)

In the following example, an "authenticated" cookie is used to determine whether or not a user should be granted access to a system.

boolean authenticated = new Boolean(getCookieValue("authenticated")).booleanValue();if (authenticated) {...}

Modifying the value of a cookie on the client-side is trivial, but many developers assume that cookies are essentially immutable.

CVE-2002-0367
DebPloit
https://www.cve.org/CVERecord?id=CVE-2002-0367

CVE-2004-0261
Web auth
https://www.cve.org/CVERecord?id=CVE-2004-0261

CVE-2002-1730
Authentication bypass by setting certain cookies to "true".
https://www.cve.org/CVERecord?id=CVE-2002-1730

CVE-2002-1734
Authentication bypass by setting certain cookies to "true".
https://www.cve.org/CVERecord?id=CVE-2002-1734

CVE-2002-2064
Admin access by setting a cookie.
https://www.cve.org/CVERecord?id=CVE-2002-2064

CVE-2002-2054
Gain privileges by setting cookie.
https://www.cve.org/CVERecord?id=CVE-2002-2054

CVE-2004-1611
Product trusts authentication information in cookie.
https://www.cve.org/CVERecord?id=CVE-2004-1611

CVE-2005-1708
Authentication bypass by setting admin-testing variable to true.
https://www.cve.org/CVERecord?id=CVE-2005-1708

CVE-2005-1787
Bypass auth and gain privileges by setting a variable.
https://www.cve.org/CVERecord?id=CVE-2005-1787

Authentication Bypass via Assumed-Immutable Data

A1
Unvalidated Input
CWE More Specific

SEC02-J
Do not base security checks on untrusted sources

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Sean Eidemiller
Cigital
2008-07-01
added/updated demonstrative examples

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2008-10-14
updated Demonstrative_Examples, Description

CWE Content Team
MITRE
2009-03-10
updated Relationships

CWE Content Team
MITRE
2010-02-16
updated Potential_Mitigations, Relationships

CWE Content Team
MITRE
2010-04-05
updated Related_Attack_Patterns

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2012-05-11
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2014-07-30
updated Demonstrative_Examples, Relationships

CWE Content Team
MITRE
2017-05-03
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2019-01-03
updated Taxonomy_Mappings

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2021-03-15
updated Demonstrative_Examples

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2022-10-13
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Type

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Relationships, Weakness_Ordinalities