Browse / Authentication

Authentication

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Improper Authentication - Generic955
• Improper Restriction of Authentication Attempts159
• Insufficiently Protected Credentials43
• Insufficient Session Expiration43
• Authentication Bypass Using an Alternate Path or Channel28
• Authentication Bypass by Primary Weakness19
• Session Fixation15
• Use of Hard-coded Credentials13
• Weak Password Recovery Mechanism for Forgotten Password11
• Plaintext Storage of a Password11
• Weak Cryptography for Passwords11
• Password in Configuration File9
• Missing Authentication for Critical Function8
• Reliance on Cookies without Validation and Integrity Checking in a Security Decision8
• Authentication Bypass6
• Unverified Password Change5
• Storing Passwords in a Recoverable Format4
• Missing Critical Step in Authentication3
• Use of Hard-coded Password3
• Use of Default Credentials2
• Key Exchange without Entity Authentication2
• Authentication Bypass by Spoofing2
• Brute Force2
• Weak Password Requirements1
• Authentication Bypass by Capture-replay1
• Unprotected Transport of Credentials1

Often found together with

• Access Control179
• Misconfiguration153
• Information Disclosure132
• Cross-site Scripting125
• Cross-Site Request Forgery79
• Insecure Direct Object Reference43
• Denial of Service35

Most upvoted Authentication reports

AllValidInformativeN/ADuplicate

1. Improper Authentication Throttling Allows Attacker-Controlled Account Lockouts InformativeImproper Restriction of Authentication Attempts · medium · Lichess
   92 votes
2. Weak Rate Limiting Controls in the (LOGIN) page Expose System to Brute Force and DoS AttacksInformativeImproper Restriction of Authentication Attempts · critical · Lichess
   74 votes
3. Email Verification Bypass via Race ConditionInformativeImproper Authentication - Generic · Malwarebytes
   70 votes
4. access to profile & reset password page without authenticationInformativeImproper Authentication - Generic · medium · Tennessee Valley Authority
   68 votes
5. Bypassing the victim's phone number OTP in the account recovery process on the https://hackerone.com/settings/auth/setup_account_recoveryInformativeImproper Authentication - Generic · critical · HackerOne
   67 votes
6. Login email verification bypass via `/oauth/token`.InformativeMissing Critical Step in Authentication · GitLab
   66 votes
7. Session Persistence Designed to Keep Users Logged In Across Multiple Devices (Intended Behaviour)InformativeSession Fixation · Shopify
   63 votes
8. Password Reuse Vulnerability on AWS Sign-in Page via Password Reset Flow leads to Security Policy ViolationInformativeWeak Password Requirements · AWS VDP
   55 votes
9. Session Replay Attack Allows Authentication Bypass via Captured Login Responses Allowing Bypass of 429 Too many attempts for Multiple Failed LoginsInformativeImproper Authentication - Generic · high · WakaTime
   54 votes
10. Any WARP User Can Access Organization-Specific ApplicationInformativeImproper Authentication - Generic · Cloudflare Public Bug Bounty
    46 votes
11. Logout Bypass Vulnerability in Hiro.soInformativeInsufficient Session Expiration · medium · Hiro
    $15045 votes
12. PIN bypassInformativeImproper Authentication - Generic · critical · MyEtherWallet
    34 votes
13. SSH/SFTP connection reuse can bypass SSH key identity after ssh_config_matches removalInformativeAuthentication Bypass by Primary Weakness · high · curl
    30 votes
14. lib/http2.c: SSL connections accept non-HTTP push schemes (incomplete fix for 2e8c922a)InformativeAuthentication Bypass by Primary Weakness · medium · curl
    30 votes
15. Replayable Password Change Request Across Sessions.InformativeInsufficient Session Expiration · Malwarebytes
    28 votes
16. 2FA Bypass via Leaked CookiesInformativeImproper Authentication - Generic · medium · HackerOne
    28 votes
17. Session Not Expire / 2FA BypassInformativeInsufficient Session Expiration · medium · HackerOne
    28 votes
18. HackerOne Vulnerability Report: libcurl SSL/TLS Identity Leakage via Insecure Connection ReuseInformativeAuthentication Bypass by Primary Weakness · curl
    26 votes
19. Login page password-guessing attackInformativeImproper Authentication - Generic · HackerOne
    23 votes
20. Can use the Reddit android app as usual even though revoking the access of it from reddit.comInformativeInsufficient Session Expiration · critical · Reddit
    20 votes
21. 12: SASL DIGEST-MD5 does not validate the server's `rspauth` proofInformativeMissing Critical Step in Authentication · curl
    19 votes
22. TOTP Authenticator implementation Accepts Expired CodesInformativeImproper Authentication - Generic · high · HackerOne
    19 votes
23. Potential DoS due to PasswordPoliciesNotMet in errors.goInformativeImproper Authentication - Generic · low · passhash
    19 votes
24. Misconfigurated login page able to lock login action for any account without user interactionInformativeImproper Authentication - Generic · critical · Reddit
    19 votes
25. Digest Auth State Leak on Cross-Origin Redirect via Netrc - Username and Password Hash Sent to Wrong HostInformativeInsufficiently Protected Credentials · medium · curl
    17 votes
26. TLS conn reuse and session cache ignore fsslctx callback and ssl_config_data flags ( incomplete fix variant of 7541ae569 )InformativeInsufficiently Protected Credentials · high · curl
    16 votes
27. Attacker can bypass authentication build on ingress external auth (`nginx.ingress.kubernetes.io/auth-url`)InformativeImproper Authentication - Generic · medium · Kubernetes
    16 votes
28. brute force attack allowed on admin page https://www.stellar.org/wp-admin/InformativeImproper Restriction of Authentication Attempts · medium · Stellar.org
    16 votes
29. Account takeoverInformativeImproper Authentication - Generic · HackerOne
    16 votes
30. Missing policies for password in password_policies.goInformativeImproper Authentication - Generic · passhash
    15 votes
31. Trailing-Dot Hostname in Redirect Silently Strips Client Certificate and Auth CredentialsInformativeImproper Authentication - Generic · medium · curl
    12 votes
32. PURGE is not authenticatedInformativeImproper Authentication - Generic · low · Yelp
    12 votes
33. Invalidate session after password reset on https://polldaddy.comInformativeInsufficient Session Expiration · Automattic
    12 votes
34. I cant login to my accountInformativeImproper Authentication - Generic · Legal Robot
    12 votes
35. Unauthorized Team members viewingInformativeImproper Authentication - Generic · HackerOne
    12 votes
36. ssh_config_matches is dead code: unauthorized SSH key reuseInformativeAuthentication Bypass by Primary Weakness · medium · curl
    11 votes
37. curl cross-origin HTTPS redirect reuses TLS client certificate for unintended second-origin mTLS authenticationInformativeInsufficiently Protected Credentials · low · curl
    11 votes
38. No Rate Limit On Regenerate Password on PortswiggerInformativeImproper Restriction of Authentication Attempts · PortSwigger Web Security
    11 votes
39. Application level DOS at Login Page ( Accepts Long Password )InformativeImproper Authentication - Generic · high · Reddit
    11 votes
40. registering with the same email address multiple times leads to account takeover InformativeImproper Authentication - Generic · low · Reddit
    11 votes
41. Sending Unlimited Emails to anyone from zomato mail server.InformativeImproper Restriction of Authentication Attempts · Eternal
    11 votes
42. Previously created sessions continue being valid after MFA activationInformativeImproper Authentication - Generic · medium · CS Money
    10 votes
43. Authentication Bypass in Updating Personal InformationInformativeImproper Authentication - Generic · Instacart
    10 votes
44. Bruteforcing help.nextcloud.comInformativeImproper Authentication - Generic · Nextcloud
    10 votes
45. Session Hijacking attack (Different Scenario)InformativeImproper Authentication - Generic · HackerOne
    10 votes
46. [rt.torproject.org] No Rate Limitting on Login FormInformativeImproper Restriction of Authentication Attempts · Tor
    9 votes
47. lib/ldap.c follows attacker-controlled LDAP referrals and binds to a second server; WinLDAP builds leak current logon credentials (confirmed on WindowInformativeInsufficiently Protected Credentials · medium · curl
    8 votes
48. Add me email address Authentication bypassInformativeImproper Authentication - Generic · LinkedIn
    8 votes
49. hardcoded api secret & api key in com.reddit.frontpageInformativeImproper Authentication - Generic · critical · Reddit
    8 votes
50. SSH port on store.greenhouse.io is vulnerable to brute force attacksInformativeImproper Restriction of Authentication Attempts · low · Greenhouse.io
    8 votes
51. Liberapay Non Verified Account Takeover with signup featureInformativeImproper Authentication - Generic · Liberapay
    8 votes
52. Bypassing Verify Humans PageInformativeImproper Authentication - Generic · Stellar.org
    8 votes
53. Session Fixation At Logout /Session MisconfigurationInformativeImproper Authentication - Generic · Gratipay
    8 votes
54. Can add employee in business.uber.com without add payment methodInformativeImproper Authentication - Generic · Uber
    8 votes
55. Login page password-guessing attack(Brute-force attack-High).InformativeImproper Authentication - Generic · IRCCloud
    8 votes
56. TLS session resumption client cert bypass with CURLOPT_SSL_CTX_FUNCTIONInformativeAuthentication Bypass by Primary Weakness · medium · curl
    7 votes
57. Self-DoS due to template injection via email field in password reset form on access.acronis.comInformativeImproper Authentication - Generic · Acronis
    7 votes
58. Password policy changes not enforced for existing passwordsInformativeWeak Cryptography for Passwords · low · Nextcloud
    7 votes
59. Email Notification should be get while changing password on apps.nextcloud.comInformativeImproper Authentication - Generic · Nextcloud
    7 votes
60. It's possible to view configuration and/or source code on uchat.awscorp.uberinternal.com without InformativeImproper Authentication - Generic · medium · Uber
    7 votes
61. Password Change not notified when changed from settingsInformativeUnverified Password Change · medium · Starbucks
    7 votes
62. curl RTSP connection reuse routes response headers to the RTP callback (rtsp_conn state machine not reset between sessions)InformativeImproper Authentication - Generic · high · curl
    6 votes
63. Recently change email but still login with old emailInformativeImproper Authentication - Generic · high · Nextcloud
    6 votes
64. Bypass Too Many Requests Sign Up InformativeAuthentication Bypass Using an Alternate Path or Channel · medium · Courier
    6 votes
65. Insecure Account DeletionInformativeImproper Authentication - Generic · Liberapay
    6 votes
66. CORS (Cross-Origin Resource Sharing)InformativeImproper Authentication - Generic · low · Semrush
    6 votes
67. Configuration and/or source code files on uchat-staging.uberinternal.com can be viewed without OneLogin SSO Authentication InformativeImproper Authentication - Generic · medium · Uber
    6 votes
68. [api.data.gov] Leak Valid API With out Verification -InformativeImproper Authentication - Generic · GSA Bounty
    6 votes
69. Login page password - guessing attackInformativeImproper Restriction of Authentication Attempts · low · WakaTime
    6 votes
70. coinbase Email leak while sending and requestingInformativeImproper Authentication - Generic · low · Coinbase
    6 votes
71. Email spoofing-fake mail from your mail domain server InformativeImproper Authentication - Generic · Legal Robot
    6 votes
72. 11: `CURLOPT_FORBID_REUSE` silently lost on multiplexed HTTP/2 connection when the forbidding transfer finishes firstInformativeAuthentication Bypass by Primary Weakness · curl
    5 votes
73. Disavowing an account doesn't disable itInformativeImproper Authentication - Generic · low · Liberapay
    5 votes
74. Able to upload backgrounds before entering 2FAInformativeImproper Authentication - Generic · medium · CS Money
    5 votes
75. No set limit to try to login in "https://auth.nextcloud.com/auth/realms/master/protocol/openid-connect/auth" page.InformativeImproper Restriction of Authentication Attempts · Nextcloud
    5 votes
76. Account Takeover with old password and login QRInformativeImproper Authentication - Generic · BCM Messenger
    5 votes
77. Broken Authentication: A project addition request can be used multiple time for different usersInformativeKey Exchange without Entity Authentication · high · Semrush
    5 votes
78. The Uber Promo Customer Endpoint Does Not Implement Multifactor Authentication, Blacklisting or Rate LimitingInformativeImproper Restriction of Authentication Attempts · high · Uber
    5 votes
79. Password Reset Does Not Confirm the Existence of an Email AddressInformativeImproper Authentication - Generic · Uber
    5 votes
80. Defect-Security | Driver-Broken Authentication | Able to update the Subscription Setting anonymouslyInformativeImproper Authentication - Generic · Uber
    5 votes
81. Password modification without knowing actual password & httpOnly bypassInformativeImproper Authentication - Generic · Bumble
    5 votes
82. No email verification during registrationInformativeImproper Authentication - Generic · ownCloud
    5 votes
83. Two-factor authentication (via SMS)InformativeImproper Authentication - Generic · Coinbase
    5 votes
84. No option to logout concurrent sessionsInformativeImproper Authentication - Generic · HackerOne
    5 votes
85. Session not expired on logoutInformativeImproper Authentication - Generic · Factlink
    5 votes
86. "SESSION" Cookie without HttpOnly flag setInformativeImproper Authentication - Generic · IRCCloud
    5 votes
87. एमएस डॉस प्राणघाती है। InformativeImproper Authentication - Generic · MS-DOS
    5 votes
88. No admin audit entry for enabling/disabling 2FAInformativeImproper Authentication - Generic · low · Nextcloud
    4 votes
89. Can link to websites from profileInformativeImproper Authentication - Generic · low · WakaTime
    4 votes
90. password token validationInformativeImproper Authentication - Generic · low · WakaTime
    4 votes
91. No password length restrictionInformativeWeak Cryptography for Passwords · Udemy
    4 votes
92. Weak credentials for nutty.ubnt.comInformativeImproper Authentication - Generic · medium · Ubiquiti Inc.
    4 votes
93. Authentication Issue for easter egg on bonjour.uber.comInformativeImproper Authentication - Generic · Uber
    4 votes
94. Missing authentication on Notification setting .InformativeImproper Authentication - Generic · Uber
    4 votes
95. auto-logout after 20 minutesInformativeImproper Authentication - Generic · low · Gratipay
    4 votes
96. Account Deleted without any confirmationInformativeImproper Authentication - Generic · X / xAI
    4 votes
97. Weak password policyInformativeImproper Authentication - Generic · IRCCloud
    4 votes
98. Password Reset Links Not ExpiringInformativeImproper Authentication - Generic · Phabricator
    4 votes
99. Account Hijacking (Only rare case scenario)InformativeImproper Authentication - Generic · HackerOne
    4 votes
100. Top 10 2013-A2-Broken Authentication and Session Management - wordpress.comInformativeImproper Authentication - Generic · Automattic
     4 votes