CWE-287: Improper Authentication
Sources read 2026-10-29. MITRE's own page · All weakness notes · Added to CISA's list in the last seven days
What it is
From MITRE's CWE catalogue
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
MITRE classes it as a class-level weakness and rates the likelihood of exploit as high.
What it lets an attacker do
From MITRE's CWE catalogue
- Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands (affects: integrity, confidentiality, availability, access control)
On CISA's exploited list
From CISA's exploited list
7 of the 108 entries CISA added from 2026-08-02 to 2026-10-30 name CWE-287, against 5 of 69 in the 90 days before. Over the whole catalogue 48 entries name it. The counts are small, so read them as a rough order, not a rate.
CISA's list is not every flaw that is exploited: it holds the ones CISA has evidence of, listed on the day it added them.
- CVE-2026-105133, Ahsay AhsayCBS, added 2026-10-14
- CVE-2026-42018, JFrog Artifactory, added 2026-09-11
- CVE-2026-59822, BerriAI LiteLLM, added 2026-09-02
- CVE-2026-49869, Kestra Kestra OSS, added 2026-09-02
- CVE-2026-82329, JFrog Artifactory, added 2026-09-02
How MITRE says to find it
From MITRE's CWE catalogue
- Automated Static Analysis
- Manual Static Analysis
- Manual Static Analysis - Binary or Bytecode
- Dynamic Analysis with Automated Results Interpretation
- Dynamic Analysis with Manual Results Interpretation
What MITRE suggests
From MITRE's CWE catalogue
These are MITRE's suggestions, quoted as it gives them. They are not a complete fix and not a substitute for reading the vendor's advisory for the product you run.
- Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Attack patterns MITRE links to it
From MITRE's CWE catalogue
Start with one piece of work.
Give us one piece of work and read access to one system. We map it and come back with what we found, what we would build and what it would take — before any commitment. You decide using our output, not our pitch.
Talk to us