CWE-302: Authentication Bypass by Assumed-Immutable Data
Base
The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
Consequences
- Access Control: Bypass Protection Mechanism
How to prevent it
- Architecture and Design, Operation, Implementation: Implement proper protection for immutable data (e.g. environment variable, hidden form fields, etc.)
Recent advisories
- GHSA-qvw7-jm5c-6hqw — Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability
- GHSA-6mq3-xmgp-pjm5 — ZITADEL's truncated opaque tokens are still valid
- GHSA-3vmm-7h4j-69rm — TYPO3 vulnerable to Weak Authentication in Session Handling
- GHSA-jfp7-79g7-89rf — TYPO3 CMS vulnerable to Weak Authentication in Frontend Login
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor