CWE-636
Not Failing Securely ('Failing Open')
When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
Impactr finds and proves whether CWE-636 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.