HighA07:2025CWE-521Authentication

Credential Stuffing

Credential stuffing is an automated attack using large sets of stolen username/password pairs (from data breaches) to gain unauthorized access. It exploits password reuse across different services.

Overview

Credential stuffing exploits the widespread habit of password reuse. Attackers use automated tools to test millions of compromised credentials against login endpoints. Unlike brute-force attacks that guess passwords, credential stuffing uses known-valid credentials from previous breaches, resulting in significantly higher success rates.

Types & Variants

Classic Credential Stuffing

Automated testing of leaked credential pairs against login forms.

Password Spraying

Testing a small number of commonly used passwords against many accounts.

Impact

Mass account compromise, data theft, financial fraud, privacy violations, resource abuse.

Examples

Automated Login Attempts

for cred in breach_list:
  response = login(cred.email, cred.password)
  if response.status == 200: save_valid(cred)

Remediation

Implement rate limiting, CAPTCHA, MFA, monitor for unusual login patterns, check passwords against breach databases (Have I Been Pwned), and enforce unique password requirements.

Enforce multi-factor authentication (MFA)

Implement progressive rate limiting and account lockout

Check new passwords against known breach databases

Deploy CAPTCHA after failed login attempts

Monitor for anomalous login patterns (geographic, device, velocity)