CWE-305
Authentication Bypass by Primary Weakness
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
Impactr finds and proves whether CWE-305 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.