CWE-603
Use of Client-Side Authentication
AI Translation Available
A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.
Status
draft
Abstraction
base
Affected Platforms
ICS/OT
Extended Description
AI Translation
Client-side authentication is extremely weak and may be breached easily. Any attacker may read the source code and reverse-engineer the authentication mechanism to access parts of the application which would otherwise be protected.
Technical Details
AI Translation
Common Consequences
access control
Impacts
bypass protection mechanism
gain privileges or assume identity
Potential Mitigations
Phases:
architecture and design
Descriptions:
•
Do not rely on client side data. Always perform server side authentication.