The description above is MITRE’s definition of CWE-321 in CWE 4.20, a variant-level weakness.
Common consequences MITRE lists
- Access Control: Bypass Protection Mechanism; Gain Privileges or Assume Identity; Read Application Data
Guides on this site
Envelope encryption and key rotation: data keys, KMS keys and backups
Encrypt each record with its own data key, wrap that key in a KMS or HSM key, and keep wrapping-key rotation, data re-encryption, key deletion and restored backups as separate, tested operations.
Contain a leaked secret, then investigate and clean up
Revoke an exposed API key, token or private key at its issuer before anything else, end the sessions it minted, check the provider's logs, then remove every copy and replace it with a credential that expires on its own.
Practice
- Bind ciphertext to the correct record · Local project
References
This page is generated from MITRE’s CWE 4.20 catalogue (released 30 April 2026) and lists every guide, fix card and lab here that cites CWE-321.
CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.