CWE · MITRE source
CWE-602Client-Side Enforcement of Server-Side Security
The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
When the server relies on protection mechanisms placed on the client side, an attacker can modify the client-side behavior to bypass the protection mechanisms, resulting in potentially unexpected interactions between the client and server. The consequences will vary, depending on what the mechanisms are trying to protect.
Last updated: 14 October 2026 20:41 UTC
OWASP Top 10 for Web (2025)
This weakness contributes to A06:2025 Insecure Design.
NIST 800-53 r5 controls PROPOSED for this weakness (0)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
| No NIST controls proposed yet. | |||
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2020-24683 UPD | 7.6 | 9.8 | 0.0148 | 2020-12-22 |
CVE-2025-51682 UPD | 7.6 | 9.8 | 0.0162 | 2025-12-01 |
CVE-2025-10640 UPD | 7.5 | 9.8 | 0.0090 | 2025-10-21 |
CVE-2025-27681 UPD | 7.4 | 9.8 | 0.0076 | 2025-03-05 |
CVE-2026-64813 | 7.4 | 10.0 | 0.0052 | 2026-07-23 |
CVE-2023-0750 UPD | 7.3 | 9.8 | 0.0045 | 2023-04-06 |
CVE-2024-12603 UPD | 7.3 | 9.8 | 0.0055 | 2024-12-13 |
CVE-2026-23478 UPD | 7.3 | 9.8 | 0.0047 | 2026-01-13 |
CVE-2026-30783 UPD | 7.3 | 9.8 | 0.0047 | 2026-03-05 |
CVE-2025-32469 UPD | 7.2 | 9.9 | 0.0131 | 2025-05-13 |
CVE-2025-33024 UPD | 7.2 | 9.9 | 0.0126 | 2025-05-13 |
CVE-2025-33025 UPD | 7.2 | 9.9 | 0.0126 | 2025-05-13 |
CVE-2022-20658 UPD | 7.1 | 9.6 | 0.0139 | 2022-01-14 |
CVE-2026-72867 UPD | 7.1 | 9.9 | 0.0095 | 2026-08-10 |
CVE-2022-1525 UPD | 7.0 | 9.1 | 0.0083 | 2022-09-06 |
CVE-2017-12161 UPD | 6.8 | 8.8 | 0.0131 | 2018-02-21 |
CVE-2026-59504 UPD | 6.8 | 9.1 | 0.0043 | 2026-08-13 |
CVE-2024-31491 UPD | 6.7 | 8.8 | 0.0083 | 2024-05-14 |
CVE-2026-42266 UPD | 6.7 | 8.8 | 0.0085 | 2026-05-13 |
CVE-2026-54104 | 6.7 | 8.8 | 0.0072 | 2026-06-18 |
CVE-2026-13901 | 6.7 | 9.6 | 0.0034 | 2026-06-30 |
CVE-2026-14109 | 6.7 | 9.6 | 0.0034 | 2026-06-30 |
CVE-2024-28029 UPD | 6.6 | 8.8 | 0.0065 | 2024-03-21 |
CVE-2024-52008 UPD | 6.6 | 8.8 | 0.0056 | 2024-11-26 |
CVE-2025-53969 UPD | 6.5 | 8.8 | 0.0040 | 2025-09-18 |