Broken Authentication

Broken Authentication covers a whole category of flaws in how an application verifies who a user is and keeps them logged in. It’s consistently one of the OWASP Top 10 categories because authentication is complex, and small mistakes in session handling or credential checks open the door to full account takeover.

Common Forms of Broken Authentication

• Weak password policies — allowing trivially guessable passwords, or no rate-limiting on login attempts (enabling brute force)
• Credential stuffing exposure — no protection against attackers testing large lists of leaked username/password pairs from other breaches
• Predictable or non-expiring session tokens — session IDs that are guessable, or that never expire even after logout
• Exposed session IDs in URLs — leaking session tokens through browser history, referer headers, or logs
• Missing multi-factor authentication on sensitive accounts

A Real-World Style Example

An application that doesn’t rate-limit login attempts lets an attacker script thousands of password guesses per minute against a known username. Without account lockout, CAPTCHA, or delay after failed attempts, brute-forcing even a moderately strong password becomes a matter of time, not difficulty.

How Defenders Fix It

• Rate limiting and account lockout after repeated failed login attempts
• Multi-factor authentication (MFA) — even if a password leaks, MFA blocks most account takeovers
• Secure session management — long, random, unpredictable session tokens; expiring sessions on logout and after inactivity
• Password hashing with strong algorithms (bcrypt, Argon2) — never storing plaintext or weakly hashed passwords
• Checking new passwords against known-breached password lists (e.g. via Have I Been Pwned’s API)