7. of Tampering II
An attacker can bypass permissions because you don’t make names canonical before checking access permissions:
|
Threat |
|
|
|
You’re using email addresses as usernames but are not considering the domain. So, when you have users with the same name working for different organizations, there is a name clash, and they gain access to the other users’ accounts. |
|
CAPEC |
N/A |
|
ASVS |
N/A |
|
CWE |
CWE-289: Authentication Bypass by Alternate Name CWE-290: Authentication Bypass by Spoofing CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization |
|
Mitigations |
|
|
| |
