CWE-603: Use of Client-Side Authentication

Base

A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.

Client-side authentication is extremely weak and may be breached easily. Any attacker may read the source code and reverse-engineer the authentication mechanism to access parts of the application which would otherwise be protected.

Consequences

Access Control: Bypass Protection Mechanism, Gain Privileges or Assume Identity

How to prevent it

Architecture and Design: Do not rely on client side data. Always perform server side authentication.

Recent advisories

GHSA-g8vr-x4qh-25qg — Keycloak: Policy bypass during WebAuthn credential registration via client-side JavaScript manipulation

All advisories for CWE-603

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor