VYPR

CWE-303

Incorrect Implementation of Authentication Algorithm

BaseDraft

Description

The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

This incorrect implementation may allow authentication to be bypassed.

Hierarchy (View 1000)

Parents

Children

Related attack patterns (CAPEC)

CAPEC-90

CVEs mapped to this weakness (101)

page 6 of 6
  • CVE-2021-21378HigMar 11, 2021
    risk 0.00cvss 8.2epss 0.02

    Envoy is a cloud-native high-performance edge/middle/service proxy. In Envoy version 1.17.0 an attacker can bypass authentication by presenting a JWT token with an issuer that is not in the provider list when Envoy's JWT Authentication filter is configured with the…