Incomplete Validation of Credentials

Non-Unique Usernames

by

Some applications that support self-registration allow users to specify their own username, and do not enforce a requirement that usernames be unique. Although rare, the authors have encountered more than one application with this behavior. This represents a design flaw for two reasons: ■ One user who shares a username with another user may also … Read more

User Impersonation Functionality

by

Some applications implement the facility for a privileged user of the application to impersonate other users, in order to access data and carry out actions within their user context. For example, some banking applications allow helpdesk operators to verbally authenticate a telephone user and then switch their application session into that user’s context in order … Read more