i-GEN opLYNX Central Authentication Bypass
CVE-2012-4688
The i-GEN opLYNX Central system provides an interface for remote connections. Publicly available tools that disable JavaScript could be used to bypass authentication on the opLYNX Central interface, allowing access to configuration settings and other information.
Why the design failed
Authentication and authorization must be enforced by trusted server-side code. JavaScript can improve the user experience, but a user controls the browser and can disable or alter client-side logic. The server must independently validate the session and authorize every protected request.