CWE-287Improper Authentication

Abstraction: Class · CVEs in our corpus: 5,122

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Last updated: 16 October 2026 10:19 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 14 mapping(s) from 6 framework(s): CSF 2.0 6 (mostly) · STIG rhel 7 3 (mostly) · STIG ubuntu 24 04 2 (mostly) · STIG ubuntu 22 04 1 (mostly) · STIG oracle linux 8 1 (mostly) · STIG rhel 8 1 (mostly)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A07:2025 Authentication Failures.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

IA-1 Policy and Procedures
IA-10 Adaptive Authentication
IA-12 Identity Proofing
IA-13 Identity Providers and Authorization Servers

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls PROPOSED for this weakness (40)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Showing the 15 most specific. Generic controls that address many weakness types are collapsed below.

Control	Title	Family	Why it addresses this CWE
`IA-1`	Policy and Procedures	IA	Documented IA policy and procedures require proper authentication mechanisms to be defined and followed, reducing improper authentication.
`IA-10`	Adaptive Authentication	IA	Requires adaptive authentication under specific conditions, directly strengthening authentication mechanisms against improper or insufficient authentication.
`IA-12`	Identity Proofing	IA	Identity proofing requires collecting, validating, and verifying evidence to resolve claims to unique individuals, directly preventing insufficient proof of identity during account establishment.
`AT-1`	Policy and Procedures	AT	Documented procedures ensure personnel are trained on authentication mechanisms, tangibly lowering the risk of improper authentication being exploited.
`AT-2`	Literacy Training and Awareness	AT	Security awareness training instructs users on secure authentication practices and avoiding credential compromise.
`AT-3`	Role-based Training	AT	Training on authentication mechanisms and best practices decreases the occurrence of improper authentication.
`AU-10`	Non-repudiation	AU	Non-repudiation requires strong authentication mechanisms to irrefutably attribute performed actions to specific individuals or processes.
`AU-14`	Session Audit	AU	Session content review can reveal authentication bypasses or failures in session establishment.
`AU-6`	Audit Record Review, Analysis, and Reporting	AU	Review of authentication-related audit records can detect improper authentication mechanisms or bypasses.
`CA-2`	Control Assessments	CA	Assessments check authentication mechanisms for correct implementation and effectiveness, reducing successful authentication bypass attempts.
`CA-3`	Information Exchange	CA	Mandating documentation of security requirements for exchanges includes specifying and enforcing authentication mechanisms between systems.
`CA-8`	Penetration Testing	CA	Penetration testing probes authentication mechanisms for bypasses, allowing identification and fixing of improper authentication issues.
`PM-13`	Security and Privacy Workforce	PM	Development programs cover authentication best practices, making weak or missing authentication less likely.
`PM-14`	Testing, Training, and Monitoring	PM	Authentication testing and monitoring activities ensure mechanisms are implemented, maintained, and resistant to bypass.
`PM-7`	Enterprise Architecture	PM	Security-conscious enterprise architecture mandates authentication mechanisms and identity management at scale, mitigating improper authentication.

Show 25 more broadly-applicable controls

`IA-13`	Identity Providers and Authorization Servers	IA	Identity providers centralize and enforce authentication mechanisms, reducing improper authentication.
`IA-2`	Identification and Authentication (Organizational Users)	IA	Requires unique identification and authentication of organizational users, directly preventing improper authentication.
`IA-3`	Device Identification and Authentication	IA	Enforces unique device identification and authentication before any connection is established, directly mitigating improper authentication weaknesses.
`IA-4`	Identifier Management	IA	Provides unique, authorized identifiers that are foundational to preventing authentication weaknesses.
`IA-7`	Cryptographic Module Authentication	IA	Directly requires implementation of compliant authentication mechanisms to cryptographic modules, preventing improper authentication.
`IA-8`	Identification and Authentication (Non-organizational Users)	IA	Mandates unique identification and authentication of non-organizational users, directly mitigating improper authentication.
`IA-9`	Service Identification and Authentication	IA	Requires unique identification and authentication of services before any communications, directly mitigating improper authentication.
`SA-11`	Developer Testing and Evaluation	SA	Authentication mechanism testing and evaluation during development identifies bypass or weakness conditions, with mandatory correction prior to system delivery.
`SA-16`	Developer-provided Training	SA	Developer-provided instruction on authentication controls improves correct implementation and ongoing operation of authentication.
`SA-3`	System Development Life Cycle	SA	Requiring explicit security roles and risk integration in the SDLC forces authentication mechanisms to be planned, documented, and validated instead of omitted or weakly implemented.
`SC-19`	Voice Over Internet Protocol	SC	Implementation guidance and monitoring requirements force proper authentication mechanisms for VoIP endpoints and sessions.
`SC-26`	Decoys	SC	Decoy authentication surfaces detect bypass attempts and deflect real credential attacks through observable malicious interactions.
`SC-40`	Wireless Link Protection	SC	Requires authentication mechanisms on the wireless link, making improper authentication weaknesses harder to exploit.
`CP-10`	System Recovery and Reconstitution	CP	System recovery re-establishes trusted authentication processes following a compromise.
`CP-13`	Alternative Security Mechanisms	CP	Delivers alternative authentication approaches to verify identity when the primary authentication mechanism is unavailable or compromised.
`PL-8`	Security and Privacy Architectures	PL	Security architectures must specify authentication requirements and approaches, making systemic authentication weaknesses harder to introduce.
`PL-9`	Central Management	PL	Centralized authentication mechanisms and policy enforcement reduce the chance of missing or weak authentication on individual components.
`PS-1`	Policy and Procedures	PS	Personnel screening, identity verification, and access-agreement requirements support reliable authentication and reduce authentication bypass opportunities.
`PS-4`	Personnel Termination	PS	Revoking authenticators and credentials eliminates the ability of terminated individuals to authenticate using prior mechanisms.
`RA-10`	Threat Hunting	RA	Hunting detects anomalous authentication patterns or successful bypasses that allow persistent unauthorized entry.
`RA-3`	Risk Assessment	RA	Assessment of authentication-related threats and vulnerabilities leads to remediation of missing or weak authentication controls.
`AC-9`	Previous Logon Notification	AC	Detects unauthorized successful logons resulting from improper authentication implementations.
`IR-10`	Integrated Information Security Analysis Team	IR	Integrated incident analysis improves detection and mitigation of authentication bypasses and failures during security events.
`MA-4`	Nonlocal Maintenance	MA	Requiring strong authentication for establishing nonlocal maintenance sessions directly mitigates improper authentication.
`SI-4`	System Monitoring	SI	Detects unauthorized use and connections stemming from authentication bypass or failure.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2021-22893` KEV	10.0	10.0	0.4717	2021-04-23
`CVE-2025-32975` KEV	10.0	10.0	0.0249	2025-06-24
`CVE-2026-20127` KEV	10.0	10.0	0.8848	2026-02-25
`CVE-2026-20182` KEV	10.0	10.0	0.9182	2026-05-14
`CVE-2026-49869` KEV	10.0	10.0	0.0209	2026-06-26
`CVE-2013-0625` KEV	9.9	9.8	0.9376	2013-01-09
`CVE-2015-7755` KEV	9.9	9.8	0.6114	2015-12-19
`CVE-2017-7921` KEV	9.9	9.8	1.0000	2017-05-06
`CVE-2016-7836` KEV	9.9	9.8	0.1923	2017-06-09
`CVE-2017-12478`	9.9	9.8	0.7827	2017-08-07
`CVE-2015-7871`	9.9	9.8	0.8176	2017-08-07
`CVE-2015-1187` KEV	9.9	9.8	0.8286	2017-09-21
`CVE-2018-3810`	9.9	9.8	0.9114	2018-01-01
`CVE-2018-10561` KEV	9.9	9.8	0.9282	2018-05-04
`CVE-2018-17153`	9.9	9.8	0.8659	2018-09-18
`CVE-2018-17431`	9.9	9.8	0.8391	2019-01-30
`CVE-2019-13372`	9.9	9.8	0.8249	2019-07-06
`CVE-2019-1937`	9.9	9.8	0.7586	2019-08-21
`CVE-2019-19006` KEV	9.9	9.8	0.5595	2019-11-21
`CVE-2013-1359`	9.9	9.8	0.8940	2020-02-11
`CVE-2015-6922`	9.9	9.8	0.8210	2020-02-17
`CVE-2020-9294`	9.9	9.8	0.7778	2020-04-27
`CVE-2020-4427` KEV	9.9	9.8	0.7003	2020-05-07
`CVE-2020-12812` KEV	9.9	9.8	0.4538	2020-07-24
`CVE-2020-17523`	9.9	9.8	0.8591	2021-02-03