Skip to content
OpenAdvisories

Weakness (CWE)

CWE-302: Authentication Bypass by Assumed-Immutable Data

Base Incomplete

The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.

How to prevent it (1 mitigation)

  1. Architecture and Design, Operation, Implementation

    Implement proper protection for immutable data (e.g. environment variable, hidden form fields, etc.)

Source: MITRE CWE-302

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.5
    CVE-2026-77508

    Weblate: Unverified REST API email changes

    Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/users/{username}/ without verifying the new address, allowing a later team invitation for that addres…

    WeblateOrg weblate