CWE-693 Protection Mechanism Failure
What this means
SiteShadow flagged a security mechanism that is present but not actually providing the intended protection (misconfigured, bypassable, inconsistent, or "fails open").
Why it matters
Failed protections can allow unauthorized access or data exposure.
- False sense of safety: teams assume a control exists, but attackers can bypass it.
- Wide blast radius: a broken "central" protection (auth middleware, WAF rules, CSP) impacts many endpoints/pages.
- Incident complexity: failures are often configuration-dependent and environment-specific.
Safer examples
1) Make protections "fail closed"
If a security check can't run (missing session, missing config, parsing error), default to deny, not allow.
2) Centralize enforcement and remove bypass paths
Use shared middleware/policies for auth, validation, and logging so every route gets the same protection.
3) Add monitoring and tests for the protection itself
Test that controls are active (headers present, auth required, rate limits enforced) and alert on drift (see A09).
How SiteShadow detects it (high level)
- Detects expected protections (auth gates, headers, validation, encryption) and flags when they're missing, inconsistent, or bypassable.
- Highlights fail-open patterns and environment-dependent toggles.
References
- CWE-693: https://cwe.mitre.org/data/definitions/693.html
---