Broken Authentication

1. 1The application accepts unlimited login attempts, doesn't detect credential stuffing, or issues session tokens that are predictable, long-lived, or not invalidated on logout.
2. 2An attacker automates login attempts using breached credential lists (credential stuffing) or brute-forces weak passwords directly, since no rate limit or lockout stops repeated attempts.
3. 3Alternatively, the attacker exploits a session-management gap - a token that never expires, a session that survives a password reset, or a JWT with no server-side revocation.
4. 4The attacker gains a valid, authenticated session for the victim's account without knowing, or having reset, their actual password.

Broken authentication is a direct path to account takeover at scale - a single leaked credential list can be tested against thousands of accounts automatically, and weak session handling extends the blast radius of any credential that does succeed.

• Rate-limit and lock out repeated failed login attempts per account and per source, and detect credential-stuffing patterns (many accounts, few passwords).
• Issue high-entropy, short-lived session tokens; invalidate them on logout, password change, and privilege change.
• Enforce multi-factor authentication for sensitive accounts and actions, and confirm MFA can't be bypassed via a parallel code path.
• Don't leak account existence through different error messages or response timing on login and password-reset flows.

Attempt automated login with common and breached credentials against a low-privilege test account to confirm rate limiting and lockout trigger; verify sessions expire, rotate on privilege change, and can't bypass MFA through an alternate endpoint.