Authentication & Secrets
Authentication Bypass
Also: login bypass, improper authentication
A flaw that lets someone be treated as logged in without proving who they are.
In more detail
Typical causes are trusting client-supplied claims, a protected path missing the check, weak password reset flows, default credentials and components that parse the same request differently. The usual classification is CWE-287. The defence is a central, deny-by-default check performed by the server on every request.