Modification of Assumed-Immutable Data (MAID)

Many applications rely on specific pieces of data remaining constant for correct and secure operation. When developers mistakenly treat certain inputs as read-only—like hidden form fields, session cookies, or DNS records—they create a weak spot. Attackers can then modify this assumed-immutable data to bypass security checks, escalate privileges, or corrupt application logic. This flaw often stems from misplaced trust in client-side controls or external systems. To prevent it, developers must validate all critical data on the server side, regardless of its perceived source or intended immutability. Never rely on client-side mechanisms like hidden fields or cookies to store security-sensitive values without verification.