Common Weakness Enumeration

A Community-Developed Dictionary of Software Weakness Types

CWE/SANS Top 25 Most Dangerous Software Errors Common Weakness Scoring System
Common Weakness Risk Analysis Framework
Home > CWE List > CWE- Individual Dictionary Definition (2.7)  

Presentation Filter:

CWE-287: Improper Authentication

Improper Authentication
Weakness ID: 287 (Weakness Class)Status: Draft
+ Description

Description Summary

When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.
+ Alternate Terms

An alternate term is "authentification", which appears to be most commonly used by people from non-English-speaking countries.


"AuthC" is typically used as an abbreviation of "authentication" within the web application security community. It is also distinct from "AuthZ," which is an abbreviation of "authorization." The use of "Auth" as an abbreviation is discouraged, since it could be used for either authentication or authorization.

+ Time of Introduction
  • Architecture and Design
  • Implementation
+ Applicable Platforms



+ Common Consequences

Technical Impact: Read application data; Gain privileges / assume identity; Execute unauthorized code or commands

This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.

+ Likelihood of Exploit

Medium to High

+ Detection Methods

Automated Static Analysis

Automated static analysis is useful for detecting certain types of authentication. A tool may be able to analyze related configuration files, such as .htaccess in Apache web servers, or detect the usage of commonly-used authentication libraries.

Generally, automated static analysis tools have difficulty detecting custom authentication schemes. In addition, the software's design may include some functionality that is accessible to any user and does not require an established identity; an automated technique that detects the absence of authentication may report false positives.

Effectiveness: Limited

Manual Static Analysis

This weakness can be detected using tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session.

Manual static analysis is useful for evaluating the correctness of custom authentication mechanisms.

Effectiveness: High

These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.

+ Demonstrative Examples

Example 1

The following code intends to ensure that the user is already logged in. If not, the code performs authentication with the user-provided username and password. If successful, it sets the loggedin and user cookies to "remember" that the user has already logged in. Finally, the code performs administrator tasks if the logged-in user has the "Administrator" username, as recorded in the user cookie.

(Bad Code)
Example Language: Perl 
my $q = new CGI;

if ($q->cookie('loggedin') ne "true") {
if (! AuthenticateUser($q->param('username'), $q->param('password'))) {
ExitError("Error: you need to log in first");
else {
# Set loggedin and user cookies.
-name => 'loggedin',
-value => 'true'
-name => 'user',
-value => $q->param('username')

if ($q->cookie('user') eq "Administrator") {

Unfortunately, this code can be bypassed. The attacker can set the cookies independently so that the code does not check the username and password. The attacker could do this with an HTTP request containing headers such as:

GET /cgi-bin/vulnerable.cgi HTTP/1.1
Cookie: user=Administrator
Cookie: loggedin=true

[body of request]

By setting the loggedin cookie to "true", the attacker bypasses the entire authentication check. By using the "Administrator" value in the user cookie, the attacker also gains privileges to administer the software.

Example 2

In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force with a large number of common words. Once the attacker gained access as the member of the support staff, he used the administrator panel to gain access to 33 accounts that belonged to celebrities and politicians. Ultimately, fake Twitter messages were sent that appeared to come from the compromised accounts.

Example 2 References:

Kim Zetter. "Weak Password Brings 'Happiness' to Twitter Hacker". 2009-01-09. <>.
+ Observed Examples
login script for guestbook allows bypassing authentication by setting a "login_ok" parameter to 1.
admin script allows authentication bypass by setting a cookie value to "LOGGEDIN".
VOIP product allows authentication bypass using in the Host header.
product uses default "Allow" action, instead of default deny, leading to authentication bypass.
chain: redirect without exit (CWE-698) leads to resultant authentication bypass.
product does not restrict access to a listening port for a critical service, allowing authentication to be bypassed.
product does not properly implement a security-related configuration setting, allowing authentication bypass.
authentication routine returns "nil" instead of "false" in some situations, allowing authentication bypass using an invalid username.
authentication update script does not properly handle when admin does not select any authentication modules, allowing authentication bypass.
use of LDAP authentication with anonymous binds causes empty password to result in successful authentication
product authentication succeeds if user-provided MD5 hash matches the hash in its database; this can be subjected to replay attacks.
chain: product generates predictable MD5 hashes using a constant value combined with username, allowing authentication bypass.
+ Potential Mitigations

Phase: Architecture and Design

Strategy: Libraries or Frameworks

Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfCategoryCategory254Security Features
Development Concepts699
ChildOfWeakness ClassWeakness Class284Improper Access Control
Development Concepts (primary)699
Research Concepts (primary)1000
ChildOfCategoryCategory718OWASP Top Ten 2007 Category A7 - Broken Authentication and Session Management
Weaknesses in OWASP Top Ten (2007) (primary)629
ChildOfCategoryCategory724OWASP Top Ten 2004 Category A3 - Broken Authentication and Session Management
Weaknesses in OWASP Top Ten (2004) (primary)711
ChildOfCategoryCategory812OWASP Top Ten 2010 Category A3 - Broken Authentication and Session Management
Weaknesses in OWASP Top Ten (2010) (primary)809
ChildOfCategoryCategory898SFP Cluster: Authentication
Software Fault Pattern (SFP) Clusters (primary)888
ChildOfCategoryCategory930OWASP Top Ten 2013 Category A2 - Broken Authentication and Session Management
Weaknesses in OWASP Top Ten (2013) (primary)928
ChildOfCategoryCategory935OWASP Top Ten 2013 Category A7 - Missing Function Level Access Control
Weaknesses in OWASP Top Ten (2013)928
ParentOfWeakness VariantWeakness Variant261Weak Cryptography for Passwords
Research Concepts (primary)1000
ParentOfWeakness VariantWeakness Variant262Not Using Password Aging
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness Base263Password Aging with Long Expiration
Research Concepts (primary)1000
ParentOfWeakness VariantWeakness Variant301Reflection Attack in an Authentication Protocol
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness Base303Incorrect Implementation of Authentication Algorithm
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness Base304Missing Critical Step in Authentication
Development Concepts (primary)699
ParentOfWeakness VariantWeakness Variant306Missing Authentication for Critical Function
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness Base307Improper Restriction of Excessive Authentication Attempts
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness Base308Use of Single-factor Authentication
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness Base309Use of Password System for Primary Authentication
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfCompound Element: CompositeCompound Element: Composite384Session Fixation
Development Concepts699
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness Base521Weak Password Requirements
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness Base522Insufficiently Protected Credentials
Research Concepts (primary)1000
ParentOfWeakness ClassWeakness Class592Authentication Bypass Issues
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness Base603Use of Client-Side Authentication
Development Concepts (primary)699
Research Concepts1000
ParentOfWeakness VariantWeakness Variant620Unverified Password Change
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness Base640Weak Password Recovery Mechanism for Forgotten Password
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness Base645Overly Restrictive Account Lockout Mechanism
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness Base798Use of Hard-coded Credentials
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness Base804Guessable CAPTCHA
Development Concepts699
Research Concepts1000
ParentOfWeakness BaseWeakness Base836Use of Password Hash Instead of Password for Authentication
Development Concepts (primary)699
Research Concepts (primary)1000
MemberOfViewView635Weaknesses Used by NVD
Weaknesses Used by NVD (primary)635
CanFollowWeakness BaseWeakness Base613Insufficient Session Expiration
Development Concepts699
Research Concepts1000
+ Relationship Notes

This can be resultant from SQL injection vulnerabilities and other issues.

+ Functional Areas
  • Authentication
+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
PLOVERAuthentication Error
OWASP Top Ten 2007A7Broken Authentication and Session Management
OWASP Top Ten 2004A3Broken Authentication and Session Management
WASC1Insufficient Authentication
+ References
OWASP. "Top 10 2007-Broken Authentication and Session Management". <>.
OWASP. "Guide to Authentication". <>.
[REF-11] M. Howard and D. LeBlanc. "Writing Secure Code". Chapter 4, "Authentication" Page 109. 2nd Edition. Microsoft. 2002.
+ Content History
Submission DateSubmitterOrganizationSource
Externally Mined
Modification DateModifierOrganizationSource
updated Time_of_Introduction
Suggested OWASP Top Ten 2004 mapping
updated Alternate_Terms, Common_Consequences, Relationships, Relationship_Notes, Taxonomy_Mappings
updated Relationships
updated Name
updated Description, Related_Attack_Patterns
updated Relationships
updated Common_Consequences, Observed_Examples
updated Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Detection_Factors, Likelihood_of_Exploit, References
updated Alternate_Terms, Detection_Factors, Potential_Mitigations, References, Relationships, Taxonomy_Mappings
updated Relationships
updated Relationships
updated Common_Consequences
updated Relationships
updated Relationships
updated Relationships
updated Relationships
Previous Entry Names
Change DatePrevious Entry Name
2008-04-11Authentication Issues
2009-01-12Insufficient Authentication
Page Last Updated: June 23, 2014