A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.

What CVEs are caused by CWE-603?

22 recorded CVEs are attributed to CWE-603, including CVE-2025-62650, CVE-2022-3218, CVE-2022-33139.

What are the consequences of CWE-603?

Exploiting CWE-603 can lead to: Bypass Protection Mechanism, Gain Privileges or Assume Identity.

Is CWE-603 actively exploited?

22 recorded CVEs are caused by CWE-603; none are currently in CISA's KEV catalog of actively exploited flaws.

CWE-603: Use of Client-Side Authentication

Overview

Client-side authentication is extremely weak and may be breached easily. Any attacker may read the source code and reverse-engineer the authentication mechanism to access parts of the application which would otherwise be protected.

Real-world CVEs

22 recorded CVEs are caused by CWE-603 (Use of Client-Side Authentication). The highest-severity and most recent are shown first. 6 new CWE-603 CVEs have been recorded so far in 2026 (6 in 2025).

CVE-2025-62650
Critical · CVSS 9.9 · EPSS 38th
2025-10-17
CVE-2022-3218
Critical · CVSS 9.8 · EPSS 99th
2022-09-19
CVE-2022-33139
Critical · CVSS 9.8 · EPSS 64th
2022-06-21
CVE-2021-43355
Fresenius Kabi Agilia Connect Infusion System use of client side authentication
Critical · CVSS 9.8 · EPSS 58th
2022-01-21
CVE-2017-7909
Critical · CVSS 9.8 · EPSS 84th
2017-05-06
CVE-2026-1363
JNC｜IAQS and I6 - Client-Side Enforcement of Server-Side Security
Critical · CVSS 9.3 · EPSS 42th
2026-01-23
CVE-2025-64119
Nuvation Energy BMS Client-side Authentication
Critical · CVSS 9.3 · EPSS 28th
2026-01-02
CVE-2025-12868
CyberTutor｜New Site Server - Use of Client-Side Authentication
Critical · CVSS 9.3 · EPSS 41th
2025-11-10
CVE-2024-39375
Critical · CVSS 9.3 · EPSS 43th
2024-06-27
CVE-2025-30042
Session generation possible with certificate number only
Critical · CVSS 9.0 · EPSS 0th
2026-03-02
CVE-2020-7591
High · CVSS 8.8 · EPSS 71th
2020-10-15
CVE-2026-42098
Authorization Bypass in Sparx Enterprise Architect
High · CVSS 8.7 · EPSS 32th
2026-05-19

Showing 12 of 22 recorded CWE-603 CVEs. Track new ones as they are published and get AI-written analysis and fixes.

Monitor CWE-603 vulnerabilities

Common consequences

What can happen when CWE-603 is exploited.

Bypass Protection Mechanism, Gain Privileges or Assume Identity

Affects: Access Control

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Architecture and Design

Implementation

Applies to

Technologies

ICS/OT

How to prevent it

Practical mitigations for CWE-603, grouped by where in the lifecycle they apply.

Architecture and Design

Do not rely on client side data. Always perform server side authentication.

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications.

Multiple vendors used client-side authentication in their OT products.

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2022-33139 — SCADA system only uses client-side authentication, allowing adversaries to impersonate other users.
CVE-2006-0230 — Client-side check for a password allows access to a server using crafted XML requests from a modified client.

How this weakness relates to others in the CWE hierarchy.

Parent

Peer

Frequently asked questions

Common questions about CWE-603.

What is CWE-603?: A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.
What CVEs are caused by CWE-603?: 22 recorded CVEs are attributed to CWE-603, including CVE-2025-62650, CVE-2022-3218, CVE-2022-33139.
How do you prevent CWE-603?: Do not rely on client side data. Always perform server side authentication.
What are the consequences of CWE-603?: Exploiting CWE-603 can lead to: Bypass Protection Mechanism, Gain Privileges or Assume Identity.
Is CWE-603 actively exploited?: 22 recorded CVEs are caused by CWE-603; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.