OWASP Mobile Top 102024Rank #3Last reviewed 2026-07-27

M3:2024: Insecure Authentication/Authorization

Authentication and authorization performed client-side, weak or bypassable biometric checks, or server-side APIs that trust the mobile client instead of enforcing authorization on every request.

How it's found

Found by replaying authenticated mobile API traffic to test session handling, biometric bypass, and whether authorization is enforced server-side.

Standards mapping

CWE: CWE-287 CWE-285 CWE-306
References: https://owasp.org/www-project-mobile-top-10/2023-risks/m3-insecure-authentication-authorization.html

Where this fits in a TurboPentest engagement

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.

Frequently asked questions

What is M3:2024 Insecure Authentication/Authorization?

Authentication and authorization performed client-side, weak or bypassable biometric checks, or server-side APIs that trust the mobile client instead of enforcing authorization on every request.

How do you find Insecure Authentication/Authorization?

Found by replaying authenticated mobile API traffic to test session handling, biometric bypass, and whether authorization is enforced server-side.

Which CWEs map to M3:2024?

M3:2024 maps to CWE-287, CWE-285, CWE-306.

Does TurboPentest test for Insecure Authentication/Authorization?

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.

Related OWASP categories

Written and reviewed by

Michel Chamberland - Founder & CEO, IntegSec

CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security

Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.

Find these issues before an attacker does

TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.

Start a pentest

OWASP Mobile Top 102024Rank #3Last reviewed 2026-07-27

M3:2024: Insecure Authentication/Authorization

Authentication and authorization performed client-side, weak or bypassable biometric checks, or server-side APIs that trust the mobile client instead of enforcing authorization on every request.

How it's found

Found by replaying authenticated mobile API traffic to test session handling, biometric bypass, and whether authorization is enforced server-side.

Standards mapping

CWE: CWE-287 CWE-285 CWE-306
References: https://owasp.org/www-project-mobile-top-10/2023-risks/m3-insecure-authentication-authorization.html

Where this fits in a TurboPentest engagement

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.

Frequently asked questions

What is M3:2024 Insecure Authentication/Authorization?

Authentication and authorization performed client-side, weak or bypassable biometric checks, or server-side APIs that trust the mobile client instead of enforcing authorization on every request.

How do you find Insecure Authentication/Authorization?

Found by replaying authenticated mobile API traffic to test session handling, biometric bypass, and whether authorization is enforced server-side.

Which CWEs map to M3:2024?

M3:2024 maps to CWE-287, CWE-285, CWE-306.

Does TurboPentest test for Insecure Authentication/Authorization?

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.

Related OWASP categories

Written and reviewed by

Michel Chamberland - Founder & CEO, IntegSec

CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security

Find these issues before an attacker does

TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.

Start a pentest