AuthenticationHighBroken authenticationAuth bypass
Authentication Issues
Flaws in proving identity - bypasses, weak credentials, broken resets, and missing rate limits.
Overview
Authentication breaks via logic flaws (alternate paths that skip checks), credential stuffing against unthrottled logins, predictable reset tokens, or trusting client-supplied identity.
How it works
Authentication breaks via logic flaws (alternate paths that skip checks), credential stuffing against unthrottled logins, predictable reset tokens, or trusting client-supplied identity.
Example
Impact
Account takeover, mass credential-stuffing compromise, and privilege escalation.
Detection
Test alternate login paths, reset-token entropy/expiry, MFA enforcement, and lockout/rate-limit behavior.
Prevention
- Rate-limit and lock out authentication and reset flows.
- Use high-entropy, short-lived, single-use reset tokens.
- Enforce MFA and never trust client-supplied identity.
- Adopt vetted auth libraries; avoid custom crypto.