CWE-289
Authentication Bypass by Alternate Name
The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.
Impactr finds and proves whether CWE-289 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.