{
  "node_id": "mitre-cwe-287-improper-authentication",
  "title": "MITRE CWE-287 - Improper Authentication",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2026-06-05",
  "bluf": "CWE-287 (Improper Authentication) is a CWE Top 25 weakness consistently present in authentication-bypass advisories across web applications, APIs, network appliances, and SaaS platforms. CWE-287 is defined as: when an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. The Common Consequences include impact on Integrity, Confidentiality, Availability, and Access Control: this weakness can expose resources or functionality to unintended actors, potentially giving attackers access to sensitive information or enabling arbitrary code execution. Specific impacts include Read Application Data, Gain Privileges or Assume Identity, and Execute Unauthorized Code or Commands. Potential Mitigations include architecture and design controls (the most fundamental being to leverage authentication frameworks or libraries such as the OWASP ESAPI Authentication feature rather than implementing custom authentication schemes). Modern authentication mitigations also include multi-factor authentication (MFA) per NIST 800-63B; phishing-resistant authentication (FIDO2, passkeys, smart cards); password hashing with adaptive functions (bcrypt, scrypt, argon2id) with appropriate work factors; secure session management (long random session IDs, secure cookie attributes, session timeout, session rotation on privilege change); account lockout or rate limiting to mitigate credential stuffing and brute force; and credential storage protection (encrypted at rest, no plaintext, no reversible hashes). CWE-287 is the parent of many specific authentication weaknesses including CWE-306 (Missing Authentication for Critical Function), CWE-307 (Improper Restriction of Excessive Authentication Attempts), CWE-521 (Weak Password Requirements), CWE-798 (Use of Hard-coded Credentials), and CWE-307 (rate limiting).",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "industry_mapping",
      "related_frameworks"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "mitre-cwe-top-25-2024-most-dangerous-weaknesses"
  ],
  "primary_citations_count": 12
}