Browse / Authentication

Authentication

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Improper Authentication - Generic955
• Improper Restriction of Authentication Attempts159
• Insufficiently Protected Credentials43
• Insufficient Session Expiration43
• Authentication Bypass Using an Alternate Path or Channel28
• Authentication Bypass by Primary Weakness19
• Session Fixation15
• Use of Hard-coded Credentials13
• Weak Password Recovery Mechanism for Forgotten Password11
• Plaintext Storage of a Password11
• Weak Cryptography for Passwords11
• Password in Configuration File9
• Missing Authentication for Critical Function8
• Reliance on Cookies without Validation and Integrity Checking in a Security Decision8
• Authentication Bypass6
• Unverified Password Change5
• Storing Passwords in a Recoverable Format4
• Missing Critical Step in Authentication3
• Use of Hard-coded Password3
• Use of Default Credentials2
• Key Exchange without Entity Authentication2
• Authentication Bypass by Spoofing2
• Brute Force2
• Weak Password Requirements1
• Authentication Bypass by Capture-replay1
• Unprotected Transport of Credentials1

Often found together with

• Access Control179
• Misconfiguration153
• Information Disclosure132
• Cross-site Scripting125
• Cross-Site Request Forgery79
• Insecure Direct Object Reference43
• Denial of Service35

Most upvoted Authentication reports

AllValidInformativeN/ADuplicate

1. Account takeover via leaked session cookieInsufficiently Protected Credentials · high · HackerOne
   $20,0001,642 votes
2. Github access token exposureImproper Authentication - Generic · critical · Shopify
   $50,0001,601 votes
3. Token leak in security challenge flow allows retrieving victim's PayPal email and plain text passwordMissing Authentication for Critical Function · high · PayPal
   $15,3001,409 votes
4. Improper Authentication - any user can login as other user with otp/logout & otp/loginImproper Authentication - Generic · critical · Snapchat
   972 votes
5. Subdomain Takeover to Authentication bypass Improper Authentication - Generic · critical · Roblox
   783 votes
6. JumpCloud API Key leaked via Open Github Repository.Use of Hard-coded Credentials · critical · Starbucks
   739 votes
7. Bypassing Digits origin validation which leads to account takeoverImproper Authentication - Generic · X / xAI
   619 votes
8. Flickr Account Takeover using AWS Cognito APIImproper Authentication - Generic · critical · Flickr
   440 votes
9. Chained Bugs to Leak Victim's Uber's FB Oauth TokenImproper Authentication - Generic · high · Uber
   427 votes
10. Account Takeover worki.ruImproper Restriction of Authentication Attempts · Mail.ru
    $1,700391 votes
11. CVE-2019-5765: 1-click HackerOne account takeover on all Android devicesImproper Authentication - Generic · Chrome
    375 votes
12. Account TakeOver at my.33slona.ruImproper Restriction of Authentication Attempts · Mail.ru
    $1,700359 votes
13. [cs.money] Open Redirect Leads to Account TakeoverImproper Authentication - Generic · medium · CS Money
    357 votes
14. OTP token bypass in accessing user settingsImproper Authentication - Generic · Razer
    $1,000339 votes
15. Reset any passwordWeak Password Recovery Mechanism for Forgotten Password · high · pixiv
    313 votes
16. Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical)Improper Authentication - Generic · Uber
    312 votes
17. 2FA bypass by sending blank codeImproper Authentication - Generic · Glassdoor
    303 votes
18. Bypass Password Authentication for updating email and phone number - Security VulnerabilityImproper Authentication - Generic · high · X / xAI
    288 votes
19. Insufficient OAuth callback validation which leads to Periscope account takeoverImproper Authentication - Generic · X / xAI
    277 votes
20. Insufficient validation on Digits bridgeImproper Authentication - Generic · X / xAI
    263 votes
21. Ability to DOS any organization's SSO and open up the door to account takeoversImproper Authentication - Generic · high · Superhuman (formerly Grammarly)
    $10,500260 votes
22. Ability to bypass email verification for OAuth grants results in accounts takeovers on 3rd partiesAuthentication Bypass Using an Alternate Path or Channel · high · GitLab
    $3,000257 votes
23. Mass Account Takeover at https://app.taxjar.com/ - No user InteractionAuthentication Bypass Using an Alternate Path or Channel · critical · Stripe
    253 votes
24. Improper Validation at Partners LoginImproper Authentication - Generic · critical · Eternal
    $2,000251 votes
25. Stealing SSO Login Tokens (snappublisher.snapchat.com)Authentication Bypass · high · Snapchat
    $7,500244 votes
26. Incorrect authorization to the intelbot service leading to ticket informationImproper Authentication - Generic · critical · TikTok
    $15,000219 votes
27. Account Takeover via Email ID Change and Forgot Password FunctionalityImproper Authentication - Generic · New Relic
    $2,048214 votes
28. HackerOne Jira integration plugin Leaked JWT to unauthorized jira usersImproper Authentication - Generic · medium · HackerOne
    $3,000213 votes
29. Mass Accounts Takeover Without any user Interaction at https://app.taxjar.com/ Authentication Bypass Using an Alternate Path or Channel · high · Stripe
    212 votes
30. 2FA Bypass leads to impersonation of legimate usersImproper Authentication - Generic · high · Drugs.com
    207 votes
31. H1514 [*.(my)shopify.com] - Viewing Password Protected ContentImproper Authentication - Generic · critical · Shopify
    $3,000192 votes
32. Authentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.comImproper Authentication - Generic · critical · Uber
    183 votes
33. GraphQL AdminGenerateSessionPayload is leaked to staff with no permissionImproper Authentication - Generic · medium · Shopify
    173 votes
34. Account Takeover via Authentication Bypass in TikTok Account RecoveryAuthentication Bypass Using an Alternate Path or Channel · critical · TikTok
    $12,000172 votes
35. Web Authentication Endpoint Credentials Brute-Force VulnerabilityImproper Authentication - Generic · HackerOne
    161 votes
36. Session works after logout from Shopify account and password of online store is displayedImproper Authentication - Generic · low · Shopify
    157 votes
37. Absence of Token expiry leads to Unauthorized login AccessImproper Authentication - Generic · critical · Affirm
    155 votes
38. h1-202 leaderboard photo discloses local wifi password Insufficiently Protected Credentials · medium · HackerOne
    145 votes
39. H1514 Session Fixation on multiple shopify-built apps on *.shopifycloud.com and *.shopifyapps.comSession Fixation · Shopify
    144 votes
40. Open Redirect on central.uber.com allows for account takeoverImproper Authentication - Generic · high · Uber
    144 votes
41. [c-api.city-mobil.ru] Client authentication bypass leads to information disclosureMissing Authentication for Critical Function · Mail.ru
    143 votes
42. Attacker can obtain write access to any federated share/public linkImproper Authentication - Generic · high · Nextcloud
    $4,000142 votes
43. Account Takeover at vseapteki.ruImproper Restriction of Authentication Attempts · Mail.ru
    $2,000142 votes
44. Reading Emails in Uber SubdomainsImproper Authentication - Generic · Uber
    141 votes
45. Mint Oauth2 access token for targeted userImproper Authentication - Generic · high · GitLab
    $5,580140 votes
46. Account TakeOver through password recovery at am.ruImproper Restriction of Authentication Attempts · Mail.ru
    $3,000139 votes
47. Yet Another OTP code Leaked in the API ResponseImproper Authentication - Generic · critical · MTN Group
    135 votes
48. total Failure of password protection while extracting seed phrase! increases attack surface area for scammersAuthentication Bypass Using an Alternate Path or Channel · medium · MetaMask
    $3,500131 votes
49. Improper bot-authentication allows to impersonate any user when sending messages in a roomImproper Authentication - Generic · high · Basecamp
    $2,000128 votes
50. vulnerabilitieImproper Authentication - Generic · Pornhub
    127 votes
51. Incorrect param parsing in Digits web authenticationImproper Authentication - Generic · X / xAI
    126 votes
52. User can upload files even after closing his accountImproper Authentication - Generic · Basecamp
    124 votes
53. FULL ACCOUNT TAKEOVERImproper Authentication - Generic · critical · MTN Group
    123 votes
54. Critical full compromise of jarvis-new.urbanclap.com via weak session signingImproper Authentication - Generic · critical · Urban Company
    $1,500123 votes
55. MySQL username and password leaked in developer.valvesoftware.com via source code dislosurePassword in Configuration File · medium · Valve
    123 votes
56. SMS Brute Force Possibility via https://youdrive.today/login/web/code can lead to Account TakeoverImproper Restriction of Authentication Attempts · Mail.ru
    121 votes
57. [CRITICAL] Full account takeover without user interaction on sign with Apple flowImproper Authentication - Generic · Glassdoor
    118 votes
58. HackerOne Code sends live password-reset tokens to Segment in automatic page eventsInsufficiently Protected Credentials · low · HackerOne
    $200115 votes
59. Account Takeover Vulnerability in Shopify Collabs Platform Due to Missing Email VerificationImproper Authentication - Generic · low · Shopify
    $800112 votes
60. [www.32red.com] Reverse proxy misconfiguration leads to 1-click account takeoverImproper Authentication - Generic · Kindred Group
    112 votes
61. Lack of Rate Limiting on Account Creation Endpoint Improper Restriction of Authentication Attempts · low · XVIDEOS
    $200110 votes
62. Able to steal bearer token from deep linkImproper Authentication - Generic · high · Basecamp
    $6,337110 votes
63. Ability to join an arbitrary workspace by utilizing a proxy to manipulate invite linksImproper Authentication - Generic · critical · Slack
    109 votes
64. Authentication Bypass Leads To Complete Account TakeveOver on ██████████Authentication Bypass Using an Alternate Path or Channel · critical · MTN Group
    109 votes
65. Bypassing Digits web authentication's host validation with HPPImproper Authentication - Generic · X / xAI
    108 votes
66. Rate limit bypass on passport.acronis.work using X-Forwarded-For request headerImproper Restriction of Authentication Attempts · medium · Acronis
    106 votes
67. Admin Authentication Bypass Lead to Admin Account Takeover Improper Authentication - Generic · medium · UPS VDP
    106 votes
68. account takeover https://qiwi.me Improper Authentication - Generic · QIWI
    106 votes
69. Account Takeover in Password Reset FunctionAuthentication Bypass · critical · Mars
    105 votes
70. Staging Rabbitmq instance is exposed to the internet with default credentialsImproper Authentication - Generic · low · Unikrn
    105 votes
71. Lack of rate limitation on careers site allows the attacker to brute force the verification codeImproper Restriction of Authentication Attempts · high · TikTok
    104 votes
72. Getting SmartDNS for free from - join.nordvpn.comImproper Authentication - Generic · Nord Security
    104 votes
73. [agent.33slona.ru] Recovery code bruteforceImproper Restriction of Authentication Attempts · Mail.ru
    104 votes
74. Leak ██████████ information in real time through API requestImproper Authentication - Generic · high · Grab
    $3,000103 votes
75. Login to any account with the emailaddressImproper Authentication - Generic · high · Eternal
    $1,000103 votes
76. Bypass a fix for report #708013Improper Restriction of Authentication Attempts · medium · Shopify
    $3,500102 votes
77. Insecure Zendesk SSO implementation by generating JWT client-sidePassword in Configuration File · high · Trint Ltd
    102 votes
78. PIN bypass in PassCodeActivity via back buttonImproper Authentication - Generic · medium · Nextcloud
    $150101 votes
79. Email OTP/2FA BypassImproper Authentication - Generic · critical · Drugs.com
    100 votes
80. password reset token leaking allowed for ATO of an Uber accountImproper Authentication - Generic · critical · Uber
    $10,000100 votes
81. No Rate Limit On Forgot Password Page Of NordVPNImproper Authentication - Generic · Nord Security
    99 votes
82. Ability to Add and Verify Uncontrolled Mobile Numbers Leading to Account Takeover (ATO)Authentication Bypass Using an Alternate Path or Channel · critical · MTN Group
    98 votes
83. JWT audience claim is not verifiedMissing Critical Step in Authentication · critical · Internet Bug Bounty
    98 votes
84. Important information leaked on GithubUse of Hard-coded Credentials · high · Equifax-vdp
    98 votes
85. 2FA bypass possible on https://authsvc.singlestore.comAuthentication Bypass · medium · SingleStore
    96 votes
86. Attacker can get vine repost user all informations even Ip address and location .Improper Authentication - Generic · X / xAI
    95 votes
87. returnUrl= allow attacker to redirect users to the another phising website and takeover credientialsImproper Authentication - Generic · medium · Insightly
    94 votes
88. Account Takeover via SMS Authentication Flow Improper Authentication - Generic · high · Zenly
    94 votes
89. POST /api/bitcoinWithdrawalFees returns financial data without authentication despite being documented as a USER OPERATION (private endpoint)Improper Authentication - Generic · medium · CoinMate.io
    93 votes
90. Out of scope: Improper Input Validation Order on /api-internal/login via password field leads to unnecessary resource consumptionImproper Authentication - Generic · low · PortSwigger Web Security
    $20092 votes
91. Improper Authentication Throttling Allows Attacker-Controlled Account Lockouts InformativeImproper Restriction of Authentication Attempts · medium · Lichess
    92 votes
92. Account takeover w/o interaction for a user that doesn't have 2fa enabled via 2fa linking and improper auth at /api/2fa/verifyImproper Authentication - Generic · medium · Helium
    92 votes
93. Unauthenticated Docker registryImproper Authentication - Generic · Imgur
    92 votes
94. Bypassing Digits bridge origin validationImproper Authentication - Generic · X / xAI
    92 votes
95. Full Admin Takeover of R3 Limited's JFrog Artifactory - 292 Users, Corda Enterprise & CBDC Supply Chain CompromisedImproper Authentication - Generic · critical · R3
    91 votes
96. Bypass of biometrics security functionality is possible in Android application (com.shopify.mobile)Improper Authentication - Generic · low · Shopify
    $50090 votes
97. [CRITICAL] -- Complete Account TakeoverImproper Authentication - Generic · Uber
    $8,00089 votes
98. Many Slack teams can be joined by abusing an improperly configured support@ inboxImproper Authentication - Generic · Slack
    88 votes
99. SAML Authentication Bypass on uchat.uberinternal.comImproper Authentication - Generic · high · Uber
    $8,50088 votes
100. No Session Expiry after log-out, attacker can reuse the old cookiesInsufficient Session Expiration · low · Shopify
     $50087 votes