Authentication, Session, and Access Control Flaws (JWT, OAuth, IDOR, Privilege Escalation)
Authentication and access control
CWES tests JWT handling, OAuth flows, session management, IDOR, and privilege escalation as one access-control domain. JWT: decode header/payload, test alg:none, weak HS256 secrets, kid path traversal/SQLi, jku/x5u SSRF, and RS256-to-HS256 confusion using the public key. OAuth: inspect redirect_uri validation, state CSRF, PKCE, implicit-flow token leakage, scope upgrades, and account-linking logic. IDOR: change object identifiers (sequential, UUID, GUID), compare horizontal and vertical roles, and test APIs directly rather than only the UI. Sessions: fixation, rotation after login, cookie flags, and server-side versus stateless revocation.
Worked example
A JWT has header {"alg":"HS256","typ":"JWT"} and payload {"user":"bob","role":"user"}. First try alg:none with an empty signature; if rejected, crack the secret with hashcat -m 16500 jwt.txt rockyou.txt. If the secret is found, re-sign a token with "role":"admin" using the same HMAC key. If the app uses RS256, attempt to sign an HS256 token using the public key as the HMAC secret. The reasoning is to test the verification path, not just the claims.
Traps
Editing Base64 without base64url re-encoding; forgetting the signature; assuming a 403 means no IDOR; missing API endpoints that lack UI checks; not testing state in OAuth; confusing authentication bypass with authorization bypass.