CWE-302
Authentication Bypass by Assumed-Immutable Data
The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
Impactr finds and proves whether CWE-302 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.