If an attacker bypasses authentication due to flaws in access control, this represents which vulnerability?

If an attacker bypasses authentication due to flaws in access control, this represents which vulnerability?

• A. Broken Access Control
• B. CRLF Injection
• C. XML External Entity Attack
• D. Timeout Exploitation

Answer: (A)

Broken Access Control is at play when the system fails to enforce who can access what and what actions they can perform, even after authentication. If an attacker can bypass login or reach restricted areas because the access controls are flawed, that’s exactly what a broken access control vulnerability looks like: the authorization rules aren’t properly enforced, allowing privileges or data beyond what’s permitted. This type of flaw is a common and critical security issue because it lets attackers move freely through the system once they get past the login screen. CRLF Injection and XML External Entity Attacks are different categories of weaknesses—one targets how inputs can manipulate HTTP headers, and the other exploits how XML parsers process external entities. Timeout exploitation generally deals with session timeouts or timing-related issues, not the fundamental failure to enforce access restrictions.

Broken Access Control is at play when the system fails to enforce who can access what and what actions they can perform, even after authentication. If an attacker can bypass login or reach restricted areas because the access controls are flawed, that’s exactly what a broken access control vulnerability looks like: the authorization rules aren’t properly enforced, allowing privileges or data beyond what’s permitted. This type of flaw is a common and critical security issue because it lets attackers move freely through the system once they get past the login screen.

CRLF Injection and XML External Entity Attacks are different categories of weaknesses—one targets how inputs can manipulate HTTP headers, and the other exploits how XML parsers process external entities. Timeout exploitation generally deals with session timeouts or timing-related issues, not the fundamental failure to enforce access restrictions.