Broken Authentication
Also known as: Authentication bypass · Credential-based attacks
Broken Authentication covers failures in the mechanisms that verify who a user is: credential handling, session management, and multi-factor enforcement. Unlike a single implementation bug, it's usually a combination of weaknesses - no rate limiting on login, session tokens that don't expire or rotate, password-reset flows that leak whether an account exists - that together let an attacker take over accounts without ever learning the real password.
How it works
- 1The application accepts unlimited login attempts, doesn't detect credential stuffing, or issues session tokens that are predictable, long-lived, or not invalidated on logout.
- 2An attacker automates login attempts using breached credential lists (credential stuffing) or brute-forces weak passwords directly, since no rate limit or lockout stops repeated attempts.
- 3Alternatively, the attacker exploits a session-management gap - a token that never expires, a session that survives a password reset, or a JWT with no server-side revocation.
- 4The attacker gains a valid, authenticated session for the victim's account without knowing, or having reset, their actual password.
Example
POST /api/login HTTP/2
Content-Type: application/json
{ "email": "victim@example.com", "password": "Summer2023!" }
# Repeated 10,000 times with breached-credential pairs - no rate limit or lockout triggeredImpact
Broken authentication is a direct path to account takeover at scale - a single leaked credential list can be tested against thousands of accounts automatically, and weak session handling extends the blast radius of any credential that does succeed.
Remediation
- Rate-limit and lock out repeated failed login attempts per account and per source, and detect credential-stuffing patterns (many accounts, few passwords).
- Issue high-entropy, short-lived session tokens; invalidate them on logout, password change, and privilege change.
- Enforce multi-factor authentication for sensitive accounts and actions, and confirm MFA can't be bypassed via a parallel code path.
- Don't leak account existence through different error messages or response timing on login and password-reset flows.
Detection & testing
Attempt automated login with common and breached credentials against a low-privilege test account to confirm rate limiting and lockout trigger; verify sessions expire, rotate on privilege change, and can't bypass MFA through an alternate endpoint.
Impactr finds and proves whether Authentication bypass — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.
Tools
Frequently asked questions
Is broken authentication the same as a weak password policy?
Weak password rules are one contributing factor, but broken authentication is broader - it includes missing rate limiting, poor session lifecycle management, and MFA bypass paths, any of which can lead to account takeover even with strong passwords.