The SameSite attribute for sensitive cookies is not set, or an insecure value is used.

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.