CWE-287 is Improper Authentication. The flaw arises when when an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. The database currently holds 653 vulnerabilities mapped to CWE-287 and 9 of them are in the CISA Known Exploited Vulnerabilities catalog.
Analyzing data...
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
| Impact | Scope | Explanation |
|---|---|---|
| Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands | Integrity, Confidentiality, Availability, Access Control | This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code. |
| Method | Approach | Effectiveness |
|---|---|---|
| Automated Static Analysis | Automated static analysis is useful for detecting certain types of authentication. A tool may be able to analyze related configuration files, such as .htaccess in Apache web servers, or detect the usage of commonly-used authentication libraries. Generally, automated static analysis tools have difficulty detecting custom authentication schemes. In addition, the software's design may include some functionality that is accessible to any user and does not require an established identity; an automated technique that detects the absence of authentication may report false positives. | Limited |
| Manual Static Analysis | This weakness can be detected using tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. Manual static analysis is useful for evaluating the correctness of custom authentication mechanisms.These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules. | High |
| Manual Static Analysis - Binary or Bytecode | According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies | SOAR Partial |
| Dynamic Analysis with Automated Results Interpretation | According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Web Application Scanner Web Services Scanner Database Scanners | SOAR Partial |
| Dynamic Analysis with Manual Results Interpretation | According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Fuzz Tester Framework-based Fuzzer | SOAR Partial |
| Manual Static Analysis - Source Code | According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Manual Source Code Review (not inspections) | SOAR Partial |
| Automated Static Analysis - Source Code | According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer | SOAR Partial |
| Automated Static Analysis | According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Configuration Checker | SOAR Partial |
| Architecture or Design Review | According to SOAR [REF-1479], the following detection techniques may be useful: ``` Highly cost effective: ``` Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.) Formal Methods / Correct-By-Construction | High |
Below are representative vulnerabilities related to this CWE, prioritized by severity.
CWE™ Program, operated by The MITRE Corporation. Copyright © 2006–2026, The MITRE Corporation. The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. CWE Terms of Use.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Review CyStack's security rating and practical recommendations for websites and edge assets.
Explore cybersecurity research from our team of security specialists.
Browse practical cybersecurity knowledge across CyStack's articles and guides.
en
