Improper Authentication

What it is

CWE-287 covers a family of weaknesses where an application fails to correctly verify the identity of an entity (user, service, device) that interacts with it. Variants include missing authentication for critical functions, broken authentication logic, weak credentials, predictable session identifiers, and authentication bypass via parameter manipulation.

Why it matters

Improper authentication maps directly to account takeover, lateral movement, and total compromise. It is the foundational weakness behind most disclosed breaches. The OWASP Top 10 elevates Broken Access Control (A01) and Identification and Authentication Failures (A07) into the top tier for this reason. HIPAA, PCI-DSS, and CMMC all impose explicit authentication-control requirements that map to this CWE.

Common patterns

• •Authentication checks that only happen client-side (the API doesn't re-verify).
• •Password comparison via == (timing-attackable) instead of constant-time comparison.
• •Session IDs generated from predictable sources (timestamps, counters, weak PRNG).
• •Token validation that decodes JWTs but does not verify the signature.
• •Routes that check 'logged in' without checking 'authorized for this resource'.
• •Backdoor or debug routes left enabled in production.

Languages affected

Example

app.post('/transfer', async (req, res) => {
  const { fromAccount, toAccount, amount } = req.body
  await db.transfer(fromAccount, toAccount, amount)
  res.json({ ok: true })
})

app.post('/transfer', requireAuth, async (req, res) => {
  const { toAccount, amount } = req.body
  const userId = req.user.id
  const fromAccount = await db.getAccountForUser(userId)
  if (!fromAccount) return res.status(403).json({ error: 'No account' })
  await db.transfer(fromAccount.id, toAccount, amount)
  res.json({ ok: true })
})

Where this fits in OWASP Top 10

Compliance framework mapping

Related CWEs