- Analyzer
- dast
- Category
- Authentication bypass
- Default severity
- Not encoded
- CWE
- Not encoded
- Execution
- Authenticated
- Authentication
- One credential
- Applicability
- url
- Availability
- stable
What it detects
Protected-route expectations contradicted by an unauthenticated response.
Evidence
Paired authenticated and unauthenticated observations for the same route.
Remediation
Enforce authentication before the handler returns protected data or performs a protected action.
Limitations
This check is limited to the applicability and evidence delivered by dast. Review the evidence in context; a match is a finding input, while confidence and policy determine its disposition.
Related reference
Analyzer Registry · Findings and release decisions · Policy and confidence
Remediation guidance: Remediation and fix verification · Baselines and suppressions