Authentication Bypass Vulnerability

CRITICAL CWE-287 · Improper Authentication

Description

Detects authentication checks that can be bypassed due to missing return statements or weak boolean logic.

How to fix

Use early returns for authentication failures to prevent bypass.

```python
if not user or not check_password_hash(user.password_hash, password):
    return jsonify({'error': 'Invalid credentials'}), 401
```

Learn more: https://shoulder.dev/learn/python/cwe-287/authentication-bypass

Applies to

Languages

🐍 Python

Frameworks

flask django fastapi

References

Documentation ↗ OWASP ↗ Learn about CWE-287

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=python-authentication-bypass .