Browse / Authentication

Authentication

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Improper Authentication - Generic955
• Improper Restriction of Authentication Attempts159
• Insufficiently Protected Credentials43
• Insufficient Session Expiration43
• Authentication Bypass Using an Alternate Path or Channel28
• Authentication Bypass by Primary Weakness19
• Session Fixation15
• Use of Hard-coded Credentials13
• Weak Password Recovery Mechanism for Forgotten Password11
• Plaintext Storage of a Password11
• Weak Cryptography for Passwords11
• Password in Configuration File9
• Missing Authentication for Critical Function8
• Reliance on Cookies without Validation and Integrity Checking in a Security Decision8
• Authentication Bypass6
• Unverified Password Change5
• Storing Passwords in a Recoverable Format4
• Missing Critical Step in Authentication3
• Use of Hard-coded Password3
• Use of Default Credentials2
• Key Exchange without Entity Authentication2
• Authentication Bypass by Spoofing2
• Brute Force2
• Weak Password Requirements1
• Authentication Bypass by Capture-replay1
• Unprotected Transport of Credentials1

Often found together with

• Access Control179
• Misconfiguration153
• Information Disclosure132
• Cross-site Scripting125
• Cross-Site Request Forgery79
• Insecure Direct Object Reference43
• Denial of Service35

Most upvoted Authentication reports

AllValidInformativeN/ADuplicate

1. Two factor authentication bypassDuplicateImproper Authentication - Generic · medium · HackerOne
   47 votes
2. Negotiate connection reuse with wrong credentials when using CURLAUTH_ANY DuplicateAuthentication Bypass by Primary Weakness · medium · curl
   45 votes
3. Negotiate Authentication Premature on Connection ReuseDuplicateImproper Authentication - Generic · high · curl
   39 votes
4. Improper Authentication - 2FA OTP ReusableDuplicateImproper Authentication - Generic · high · HackerOne
   31 votes
5. Hackers can Invite Collaborators Without 2FA on Programs Requiring 2FADuplicateImproper Authentication - Generic · medium · HackerOne
   13 votes
6. Missing rate limit in current password change settings leads to Account takeoverDuplicateImproper Restriction of Authentication Attempts · medium · Reddit
   13 votes
7. Inadequate cache control in gitter allows to view private chat roomDuplicateImproper Authentication - Generic · GitLab
   13 votes
8. No rate limit leads to spaming postDuplicateImproper Authentication - Generic · medium · Reddit
   11 votes
9. Private KEY of crypto walletDuplicateUse of Hard-coded Password · Sifchain
   11 votes
10. Rate limit is implemented in Reddit , but its not working . DuplicateImproper Authentication - Generic · low · Reddit
    9 votes
11. Failed to validate Session after Password ChangeDuplicateInsufficient Session Expiration · low · UPchieve
    9 votes
12. User Account has been taken outDuplicateWeak Cryptography for Passwords · critical · Reddit
    9 votes
13. Authentication Bypass - Email Verification code bypass in account registration process.DuplicateImproper Authentication - Generic · critical · UPchieve
    8 votes
14. No Rate limit on change password leads to account takeoverDuplicateImproper Restriction of Authentication Attempts · low · Reddit
    8 votes
15. Invalidate session after password reset - hosted websiteDuplicateImproper Authentication - Generic · low · Weblate
    8 votes
16. Bypassing the SMS sending limit for download app link.DuplicateImproper Restriction of Authentication Attempts · low · Eternal
    7 votes
17. NextCloud is also Accepting OCTET-STREAM Type of Documents instead of jpg or Imge Files OnlyDuplicateImproper Authentication - Generic · Nextcloud
    7 votes
18. Session Not Expired On LogoutDuplicateImproper Authentication - Generic · WakaTime
    7 votes
19. Lack of Password Confirmation when Changing Password and EmailDuplicateImproper Authentication - Generic · WordPress
    7 votes
20. Subdomain Takeover of Brave.comDuplicateImproper Authentication - Generic · Brave Software
    7 votes
21. No authorization required in iOS device web-applicationDuplicateImproper Authentication - Generic · Coinbase
    7 votes
22. [www.stripo.email] There is no rate limit for /it/contact-us/ endpointsDuplicateImproper Authentication - Generic · low · Stripo Inc
    6 votes
23. Application Error disclosure, Verification token seen error and user able to change passwordDuplicateImproper Authentication - Generic · Kartpay
    6 votes
24. Cross-origin resource sharing misconfig DuplicateImproper Authentication - Generic · low · Semrush
    6 votes
25. NON VALIDATION OF SESSIONS AFTER PASSWORD CHANGEDuplicateImproper Authentication - Generic · Udemy
    6 votes
26. Login page password-guessing attackDuplicateImproper Authentication - Generic · Localize
    6 votes
27. No Rate Limit protection in user subscription formDuplicateImproper Restriction of Authentication Attempts · low · Sifchain
    5 votes
28. Session not expired on logoutDuplicateImproper Authentication - Generic · WakaTime
    5 votes
29. No authorization required in Windows phone web-applicationDuplicateImproper Authentication - Generic · Coinbase
    5 votes
30. SMTP server allows anonymous relay from internal addresses to internal addressesDuplicateImproper Authentication - Generic · Paragon Initiative Enterprises
    5 votes
31. Use Partner/Driver App Without Being ActivatedDuplicateImproper Authentication - Generic · Uber
    5 votes
32. Email spoofingDuplicateImproper Authentication - Generic · Sifchain
    4 votes
33. Unsecured Grafana instance on https://monitoring.prow-canary.k8s.io/dashboardsDuplicateImproper Authentication - Generic · high · Kubernetes
    4 votes
34. Email Spoofing With Your Website's EmailDuplicateImproper Authentication - Generic · Paragon Initiative Enterprises
    4 votes
35. No Valid SPF Records/don't have DMARC recordDuplicateImproper Authentication - Generic · Sifchain
    3 votes
36. load scripts DOS vulnerabilityDuplicateImproper Restriction of Authentication Attempts · high · BlockDev Sp. Z o.o
    3 votes
37. No Confirmation or Notification During Email Change which can leads to account takeoverDuplicateImproper Authentication - Generic · medium · Infogram
    3 votes
38. Limited Account Takeover via Backup codes DuplicateImproper Authentication - Generic · Inflection
    3 votes
39. No rate limiting on password protected shared file linkDuplicateImproper Authentication - Generic · Nextcloud
    3 votes
40. Unauthorized file (invoice) downloadDuplicateImproper Authentication - Generic · Uber
    3 votes
41. No Valid SPF RecordsDuplicateImproper Authentication - Generic · medium · Dropcontact
    2 votes
42. No valid SPF record not foundDuplicateImproper Authentication - Generic · Ping Identity
    2 votes
43. User enumeration via forgot password error messageDuplicateImproper Authentication - Generic · medium · Infogram
    2 votes
44. Subdomain Takeover on OWOX.RUDuplicateImproper Authentication - Generic · critical · OWOX, Inc.
    2 votes
45. All Plugins - Direct file access to plugin files VulnerabilityDuplicateImproper Authentication - Generic · Ian Dunn
    2 votes
46. After removing app from facebook app session not expiring.DuplicateImproper Authentication - Generic · Gratipay
    2 votes
47. User credentials are not strong on vault.uber.comDuplicateImproper Authentication - Generic · Uber
    2 votes
48. Session retention is present which reveals the customer infoDuplicateImproper Authentication - Generic · Uber
    2 votes
49. There is any issue No valid SPF RecordsDuplicateImproper Authentication - Generic · Kubernetes
    1 votes
50. No notification on Password ChangeDuplicateImproper Authentication - Generic · medium · Infogram
    1 votes
51. Failure to Invalid Session after Password ChangeDuplicateImproper Authentication - Generic · Rockset