{"@ID": "1470", "@Name": "Improper External Identity Verification", "@Abstraction": "Class", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The product supports user accounts that include a user's external\n\t\tidentifier or communications channel - such as email, phone number,\n\t\tsocial media account, or domain name - but it does not properly verify\n\t\tthat the user actually controls the associated identifier or channel.", "Related_Weaknesses": {"Related_Weakness": [{"@Nature": "ChildOf", "@CWE_ID": "285", "@View_ID": "1000", "@Ordinal": "Primary"}, {"@Nature": "ChildOf", "@CWE_ID": "923", "@View_ID": "1000"}]}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}, "Architecture": {"@Class": "Not Architecture-Specific", "@Prevalence": "Undetermined"}, "Technology": {"@Class": "Not Technology-Specific", "@Prevalence": "Undetermined"}}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Architecture and Design", "Note": null}}, "Common_Consequences": {"Consequence": {"Scope": ["Access Control", "Authentication"], "Impact": ["Gain Privileges or Assume Identity", "Bypass Protection Mechanism"], "Note": {"xhtml:p": "If an external identifier is controlled by an attacker, such as\n\t\t\t\tan email address, then the attacker might be able to perform a\n\t\t\t\t\"pre-hijacking attack\" against a victim who creates or recovers their\n\t\t\t\taccount.", "#text_blocks": ["If an external identifier is controlled by an attacker, such as\n\t\t\t\tan email address, then the attacker might be able to perform a\n\t\t\t\t\"pre-hijacking attack\" against a victim who creates or recovers their\n\t\t\t\taccount."]}}}, "Potential_Mitigations": {"Mitigation": {"Phase": ["Architecture and Design", "Implementation"], "Description": {"xhtml:p": "Before changing the contact information, send a message\n\t\t\t\tto the user with a confirmation code. Only make the change when the\n\t\t\t\tuser provides the correct code. Ensure that the confirmation code is\n\t\t\t\texpired and rendered invalid if the user does not respond quickly\n\t\t\t\tenough.", "#text_blocks": ["Before changing the contact information, send a message\n\t\t\t\tto the user with a confirmation code. Only make the change when the\n\t\t\t\tuser provides the correct code. Ensure that the confirmation code is\n\t\t\t\texpired and rendered invalid if the user does not respond quickly\n\t\t\t\tenough."]}}}, "References": {"Reference": [{"@External_Reference_ID": "REF-1572"}, {"@External_Reference_ID": "REF-1573"}, {"@External_Reference_ID": "REF-1574"}]}, "Mapping_Notes": {"Usage": "Allowed-with-Review", "Rationale": "This CWE Entry is a Class and might have lower-level children that would be more appropriate", "Comments": "Examine children of this entry to see if there is a better fit", "Reasons": {"Reason": {"@Type": "Abstraction"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2026-10-26", "Submission_Version": "5.0", "Submission_ReleaseDate": "2026-10-28"}, "Contribution": [{"@Type": "Content", "Contribution_Name": "Kurt Seifried", "Contribution_Organization": "Cloud Security Alliance", "Contribution_Date": "2022-06-22", "Contribution_Version": "5.0", "Contribution_ReleaseDate": "2026-10-28", "Contribution_Comment": "Submitted a detailed suggestion for external identity verification"}, {"@Type": "Content", "Contribution_Name": "Michal Biesieda", "Contribution_Date": "2023-02-06", "Contribution_Version": "5.0", "Contribution_ReleaseDate": "2026-10-28", "Contribution_Comment": "Submitted missing use of verification links for external identity verification"}]}, "entry_type": "Weakness"}