Broken Authentication
Broken authentication is flaws in authentication implementations (weak passwords, session fixation, credential stuffing) that let attackers impersonate users.
Purpose
To understand identity impersonation caused by authentication flaws and their defenses; it is an OWASP Top 10 vulnerability.
Mechanism
Flaws include allowing weak passwords, no session-ID rotation on fixation, no credential-stuffing protection, predictable session tokens, and non-expiring sessions. Defenses: strong password policies, secure session management, MFA, rate limiting.
Use cases
- Authentication security audit
- Session management
- Credential protection