CWE-289 (使用候选名称进行的认证绕过) — Vulnerability Class 21

CWE-289 represents an authentication bypass vulnerability where systems rely on a single identifier to verify access rights without validating alternative names associated with the same resource or actor. Attackers typically exploit this by utilizing alternate aliases, such as symbolic links, IP addresses, or domain variations, to circumvent security controls that only check the primary name. This oversight allows unauthorized users to gain access to protected assets by presenting a valid but unverified identifier. To prevent this weakness, developers must implement comprehensive identity resolution mechanisms that map all possible names for a resource or user to a single canonical identity. By ensuring that authentication checks apply to every potential alias and enforcing strict validation of all name variations, organizations can eliminate the ambiguity that enables attackers to bypass security boundaries effectively.