This flaw creates a fundamental trust issue. Since an attacker has full control over their own client—whether it's a browser, mobile app, or API client—they can easily bypass, remove, or manipulate any client-side security checks. The server, operating under the false assumption that these checks are reliable, then processes malicious or unauthorized requests. The impact depends entirely on what the client was supposed to protect. Common consequences include unauthorized data access, privilege escalation, data corruption, or complete system compromise. The root cause is a design error: security must always be enforced at the point where trust is established and data is ultimately processed—the server.