Broken Authentication
Broken authentication encompasses weaknesses in authentication mechanisms that allow attackers to compromise passwords, session tokens, or exploit implementation flaws to assume the identities of other users.
Overview
Broken Authentication is a critical vulnerability class that encompasses a wide range of authentication and session management weaknesses. When authentication mechanisms are improperly implemented, attackers can compromise passwords, keys, session tokens, or exploit other flaws to temporarily or permanently assume the identities of other users.
Types & Variants
Credential-Based Attacks
Brute force, credential stuffing, default credentials, and weak password policies.
Session Management Flaws
Session fixation, predictable session IDs, improper session invalidation.
Token-Based Attacks
JWT vulnerabilities, token replay, missing token expiration.
Impact
Account takeover, identity theft, unauthorized access to sensitive data and functionality, lateral movement within the application.
Examples
Credential Stuffing
Automated testing of leaked username:password pairs from data breaches against the login endpoint.
Remediation
Implement multi-factor authentication, enforce strong password policies, use secure session management, implement account lockout mechanisms, and avoid exposing session IDs in URLs.
Implement multi-factor authentication (MFA)
Enforce strong password policies with breach-checking
Implement progressive delays and account lockout after failed attempts
Use secure, unpredictable session identifiers
Invalidate sessions on logout and password change
Implement proper session timeout mechanisms
Related SuperClue scanner checks
These scanner checks look for signs of Broken Authentication. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works