Free scan↗
  • English
  • Deutsch

CAPEC-21 Exploitation of Trusted Identifiers

abstraction: metastatus: active
likelihood: Highseverity: High
01

weaknesses (9)

The CWE weakness classes this flaw belongs to.

  • CWE-290Authentication Bypass by Spoofing
  • CWE-302Authentication Bypass by Assumed-Immutable Data
  • CWE-346Origin Validation Error
  • CWE-384Session Fixation
  • CWE-539Use of Persistent Cookies Containing Sensitive Information
  • CWE-6J2EE Misconfiguration: Insufficient Session-ID Length
  • CWE-602Client-Side Enforcement of Server-Side Security
  • CWE-642External Control of Critical State Data
  • CWE-664Improper Control of a Resource Through its Lifetime
02

ATT&CK techniques

ATT&CK techniques this enables or maps to.

  • T1134Access Token Manipulation
  • T1528Steal Application Access Token
  • T1539Steal Web Session Cookie
03

related attack patterns (4)

Related entries.

  • CAPEC-196Session Credential Falsification through Forging
  • CAPEC-510SaaS User Request Forgery
  • CAPEC-593Session Hijacking
  • CAPEC-62Cross Site Request Forgery
04

source

Where this definition is published.

MITRE CAPEC↗
by temnirPrivacySources
Built in Europe© 2026 datadir s.r.o.
v0.1.142checking…