CWE-603
Use of Client-Side Authentication
Description
A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.
Client-side authentication is extremely weak and may be breached easily. Any attacker may read the source code and reverse-engineer the authentication mechanism to access parts of the application which would otherwise be protected.
Parent Weaknesses (ChildOf)
Related Weaknesses
Common Consequences
Scope
Impact
Bypass Protection Mechanism, Gain Privileges or Assume Identity
Potential Mitigations
Do not rely on client side data. Always perform server side authentication.
CVE-2022-33139SCADA system only uses client-side authentication, allowing adversaries to impersonate other users.
CVE-2006-0230Client-side check for a password allows access to a server using crafted XML requests from a modified client.
Applicable Platforms
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now