Broken authentication encompasses weaknesses in session management, credential handling, and identity verification that allow attackers to compromise user accounts.
Broken Authentication refers to a broad category of vulnerabilities in how applications handle user identity, authentication, and session management. These weaknesses allow attackers to compromise passwords, keys, session tokens, or exploit other implementation flaws to assume other users' identities.
Common authentication vulnerabilities include: permitting weak or well-known passwords; using credential stuffing or brute force without rate limiting; storing passwords in plain text or with weak hashing algorithms; missing or ineffective multi-factor authentication; exposing session IDs in URLs; not rotating session IDs after login; not properly invalidating sessions on logout or timeout; and using predictable or insufficiently random session tokens.
Authentication is the front door of your application. If broken, attackers can impersonate any user, including administrators. This gives them full access to sensitive data, the ability to modify or delete records, and potentially control over the entire application. Broken authentication is particularly dangerous because compromised admin accounts can lead to complete system takeover. Credential stuffing attacks (using credentials leaked from other breaches) succeed because users reuse passwords across services. Without rate limiting, attackers can try millions of credential combinations automatically.
Use a battle-tested authentication provider like Clerk, Auth0, or Supabase Auth rather than building your own. Enforce strong password policies and check passwords against known breach databases (e.g., HaveIBeenPwned). Implement multi-factor authentication (MFA) for all users, especially administrators. Apply rate limiting and account lockout policies on login endpoints. Use secure, HttpOnly, SameSite cookies for session management. Regenerate session IDs after successful login. Implement proper session timeout and invalidation on logout. Use bcrypt, scrypt, or Argon2 for password hashing. Log and monitor authentication events to detect brute force attempts.
Select your framework for a detailed guide on fixing Broken Authentication with framework-specific code examples and security checklists.
Cross-Site Scripting (XSS)
XSS allows attackers to inject malicious scripts into web pages viewed by other users, enabling session hijacking, data theft, and defacement.
SQL Injection
SQL Injection allows attackers to interfere with database queries, potentially reading, modifying, or deleting data, and in some cases executing system commands.
Cross-Site Request Forgery (CSRF)
CSRF forces authenticated users to execute unwanted actions on a web application, exploiting the trust a site has in a user's browser.
Insecure Direct Object References (IDOR)
IDOR occurs when an application exposes internal implementation objects (like database IDs) and fails to verify that users are authorized to access the referenced resource.
Security Misconfiguration
Security misconfiguration encompasses insecure default settings, open cloud storage, verbose error messages, unnecessary features, and missing security headers.
Sensitive Data Exposure
Sensitive data exposure occurs when applications fail to adequately protect sensitive information like credentials, tokens, personal data, or financial information.
Missing Rate Limiting
Missing rate limiting allows attackers to perform brute force attacks, credential stuffing, API abuse, and denial of service by making unlimited requests.
JWT Vulnerabilities
JWT vulnerabilities include algorithm confusion, missing validation, token leakage, and improper key management that can lead to authentication bypass.
Path Traversal
Path traversal allows attackers to access files and directories stored outside the intended directory by manipulating file path references.
Command Injection
Command injection allows attackers to execute arbitrary operating system commands on the server through vulnerable application interfaces.
Server-Side Request Forgery (SSRF)
SSRF allows attackers to induce the server to make HTTP requests to arbitrary destinations, potentially accessing internal services, metadata APIs, and private networks.
File Upload Vulnerabilities
Insecure file upload handling can allow attackers to upload malicious files including web shells, malware, or files that exploit server-side processing.
Insecure Deserialization
Insecure deserialization allows attackers to manipulate serialized objects to achieve remote code execution, replay attacks, injection, or privilege escalation.
Row Level Security (RLS) Bypass
RLS bypass vulnerabilities occur when database-level access policies are missing, misconfigured, or can be circumvented, exposing data across tenant boundaries.
SafeVibe runs automated penetration tests to detect Broken Authentication and 14 other vulnerability types in your application.
Start Free Scan