Broken Authentication

Description

Broken authentication covers a broad class of implementation flaws in the mechanisms an application uses to verify user identity and maintain session state. Unlike a single root-cause vulnerability, it manifests across multiple points in the authentication lifecycle — credential creation, verification, session issuance, maintenance, and termination.

The class includes: weak or credential-stuffable passwords, missing or bypassable multi-factor authentication, predictable or long-lived session tokens, insecure password reset flows, and session state that persists beyond logout.

How It Works

Credential stuffing is the most common initial access technique. Attackers use lists of breached username/password pairs — often purchased from previous data breaches — and test them against the target application. Applications without rate limiting or lockout policies allow tens of thousands of attempts per hour with no detection.

Password reset flaws are a reliable escalation path. Common patterns include:

• Reset tokens that do not expire.
• Reset tokens that are sequential or predictable (short numeric codes, timestamp-derived values).
• Reset links that remain valid after use.
• Security questions as a fallback that can be answered from social media.

Session management failures include:

• Session tokens with insufficient entropy (easily bruted).
• Tokens that do not rotate after privilege escalation or re-authentication.
• Sessions that remain valid after password change or explicit logout.
• Tokens transmitted in URL parameters (logged in proxies, referrer headers, browser history).

Impact

• Account takeover — authenticate as any user, including administrators, without knowing their password.
• Privilege escalation — chain with other vulnerabilities (IDOR, mass assignment) from a compromised high-privilege account.
• Data breach — access all data visible to the compromised account.
• Business logic bypass — elevated accounts may disable billing, approve transactions, or export data at scale.
• Compliance failure — every major framework (SOC 2, ISO 27001, PCI DSS, HIPAA) explicitly requires robust authentication controls.

Detection

Authentication testing should be systematic across the entire auth lifecycle:

1. Brute force and rate limiting — attempt repeated logins with incorrect passwords. Confirm that the application enforces rate limiting, lockout, or CAPTCHA after a defined number of failures.
2. Password policy — attempt to set passwords that are short, common, or identical to the username. Confirm the policy is enforced server-side, not just client-side.
3. Multi-factor authentication — attempt to authenticate without completing MFA. Test whether MFA can be skipped by manipulating the session or request state.
4. Password reset flow — collect reset tokens across multiple requests and analyse for patterns. Test whether tokens expire and whether they are invalidated after use.
5. Session lifecycle — log out, then attempt to reuse the session token. Change the password, then attempt to reuse sessions issued before the change.
6. Token analysis — decode tokens and examine entropy, expiry, and claim validation behaviour.

Remediation

Implement multi-factor authentication for all accounts, especially privileged ones. TOTP (RFC 6238) is the minimum bar; hardware security keys (WebAuthn/FIDO2) are stronger.

Enforce strong password policies. Require a minimum length (12+ characters), check against common password lists (Have I Been Pwned API), and do not impose arbitrary complexity rules that encourage predictable substitutions.

Rate-limit authentication endpoints. Apply progressive delays or account lockout after repeated failures. Distinguish between lockout (risky — enables denial of service) and rate limiting with CAPTCHA challenge (preferred).

Secure the password reset flow. Use cryptographically random tokens of at least 128 bits, expire them after 15 minutes, and invalidate them immediately on use.

Manage sessions securely. Issue new session tokens at every privilege change. Set appropriate Secure, HttpOnly, and SameSite cookie flags. Invalidate all server-side sessions on logout and password change.