CWE-302 (使用假设不可变数据进行的认证绕过) — Vulnerability Class 38

CWE-302 represents a critical authentication weakness where systems rely on data elements presumed to be immutable for security decisions, yet these elements remain vulnerable to attacker manipulation. This flaw typically arises when developers trust inputs, such as HTTP headers or client-side tokens, without verifying their integrity or origin. Attackers exploit this by modifying these assumed-constant values to bypass access controls, impersonate users, or escalate privileges, effectively circumventing the intended authentication mechanism. To mitigate this risk, developers must implement robust validation strategies that treat all external inputs as potentially hostile. This includes verifying data integrity through cryptographic signatures, enforcing strict server-side state management, and avoiding reliance on client-controlled variables for critical security logic. By ensuring that authentication data cannot be altered by the user, organizations can prevent unauthorized access and maintain the integrity of their security architecture.