Improper Control of Dynamically-Identified Variables

Many programming languages provide dynamic variable access features—like using string inputs to directly reference variable names—which can accelerate development by offering great flexibility. However, when these features accept unvalidated user input, they create a dangerous pathway for attackers to manipulate critical variables controlling authentication, authorization, or application logic. This risk is especially severe because attackers can often guess or discover variable names with security significance, such as those holding user permissions, configuration flags, or sensitive data. To prevent this, developers must avoid using dynamic variable access with user-controlled input entirely, or implement strict allow-list validation to restrict which variable names can be referenced through these mechanisms.