CWE-421

Race Condition During Access to Alternate Channel

Base

Draft

The product opens an alternate channel to communicate with an authorized user, but the channel is accessible to other actors.

This creates a race condition that allows an attacker to access the channel before the authorized user does.

Parent Weaknesses (ChildOf)

Scope

Access Control

Impact

Gain Privileges or Assume Identity, Bypass Protection Mechanism

FTP "Pizza Thief" vulnerability. Attacker can connect to a port that was intended for use by another client.

Product creates Windows named pipe during authentication that another attacker can hijack by connecting to it.

Not Language-Specific

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.