Browse / Authentication

Authentication

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Improper Authentication - Generic955
• Improper Restriction of Authentication Attempts159
• Insufficiently Protected Credentials43
• Insufficient Session Expiration43
• Authentication Bypass Using an Alternate Path or Channel28
• Authentication Bypass by Primary Weakness19
• Session Fixation15
• Use of Hard-coded Credentials13
• Weak Password Recovery Mechanism for Forgotten Password11
• Plaintext Storage of a Password11
• Weak Cryptography for Passwords11
• Password in Configuration File9
• Missing Authentication for Critical Function8
• Reliance on Cookies without Validation and Integrity Checking in a Security Decision8
• Authentication Bypass6
• Unverified Password Change5
• Storing Passwords in a Recoverable Format4
• Missing Critical Step in Authentication3
• Use of Hard-coded Password3
• Use of Default Credentials2
• Key Exchange without Entity Authentication2
• Authentication Bypass by Spoofing2
• Brute Force2
• Weak Password Requirements1
• Authentication Bypass by Capture-replay1
• Unprotected Transport of Credentials1

Often found together with

• Access Control179
• Misconfiguration153
• Information Disclosure132
• Cross-site Scripting125
• Cross-Site Request Forgery79
• Insecure Direct Object Reference43
• Denial of Service35

Most upvoted Authentication reports

AllValidInformativeN/ADuplicate

1. Windows SSPI connection-pool probe can reuse a connection under the wrong userN/AAuthentication Bypass by Spoofing · medium · curl
   39 votes
2. Cross‑origin cookies leak and injection risk when using a custom Host headerN/AInsufficiently Protected Credentials · curl
   30 votes
3. cookie is sent on redirectN/AInsufficiently Protected Credentials · medium · curl
   30 votes
4. Broken Authentication and session management OWASP A2N/AImproper Authentication - Generic · Liberapay
   24 votes
5. libcurl: Integer truncation in curl_easy_ssls_import() causes TLS sessions to never expireN/AImproper Authentication - Generic · medium · curl
   23 votes
6. Bearer Token Leaked to Attacker via .netrc Despite CVE-2026-3783 FixN/AImproper Authentication - Generic · curl
   23 votes
7. Incorrect Parsing of IPv6 Zone ID in curlN/AAuthentication Bypass by Primary Weakness · high · curl
   21 votes
8. Session hijacking attackN/AImproper Authentication - Generic · HackerOne
   21 votes
9. Connection Reuse Ignores OAuth Bearer Token MismatchN/AImproper Authentication - Generic · medium · curl
   17 votes
10. libcurl: Improper Authentication State Management on Cross-Protocol RedirectsN/AInsufficiently Protected Credentials · low · curl
    17 votes
11. Missing server identity policy enforcement in SSH connection reuse allows host key verification bypass via pool poisoningN/AAuthentication Bypass by Primary Weakness · high · curl
    16 votes
12. Speculative Execution Side-Channel in `curl` N/AAuthentication Bypass by Primary Weakness · medium · curl
    16 votes
13. Session not expired When logout [partners.uber.com]N/AImproper Authentication - Generic · Uber
    12 votes
14. SOCKS5 no-auth accepted despite username/password-only authenticationN/AImproper Authentication - Generic · medium · curl
    10 votes
15. curl CONNECT response header colon-check bypass in cf-h1-proxy single_header — proxy authentication bypass via injected HTTP/1.x status lineN/AImproper Authentication - Generic · high · curl
    9 votes
16. Broken Authentication & Session Management - Failure to Invalidate Session on all other browsers at Password changeN/AImproper Authentication - Generic · critical · Paragon Initiative Enterprises
    9 votes
17. There is vulnebility Click Here TO fixN/AImproper Restriction of Authentication Attempts · medium · Brave Software
    8 votes
18. Improper Restriction of Authentication Attempts in cURLN/AImproper Restriction of Authentication Attempts · critical · curl
    7 votes
19. Rate limit Bypass on contact-us through IP Rotator (burp extension)(https://www.linkedin.com/help/linkedin/solve/contact)N/AImproper Restriction of Authentication Attempts · LinkedIn
    7 votes
20. Broken Authentication and session management OWASP A2N/AImproper Authentication - Generic · WakaTime
    7 votes
21. Improper authentication on registrationN/AImproper Authentication - Generic · medium · Semrush
    7 votes
22. Password Reset page Session FixationN/ASession Fixation · medium · Legal Robot
    7 votes
23. Session Fixation on AcronisN/ASession Fixation · medium · Acronis
    6 votes
24. Two-factor authentication (2FA) BypassN/AAuthentication Bypass Using an Alternate Path or Channel · critical · BlockDev Sp. Z o.o
    6 votes
25. the login blocking mechanism does not work correctlyN/AImproper Restriction of Authentication Attempts · medium · Semmle
    6 votes
26. Server Side Misconfiguration (EMAIL SPOOFING) N/AImproper Authentication - Generic · GSA Bounty
    6 votes
27. SSH host-key policy is missing from the connection-reuse tuple: strict pins and knownhosts are silently skipped on reused SFTP/SCP connectionsN/AAuthentication Bypass by Primary Weakness · low · curl
    5 votes
28. CURLOPT_PROXYHEADER is not part of the HTTP-proxy connection reuse key: a second CONNECT-tunnel transfer silently reuses the first tunnel's Proxy-AuthN/AImproper Authentication - Generic · medium · curl
    5 votes
29. Credential leak on redirectN/AInsufficiently Protected Credentials · medium · curl
    5 votes
30. No Rate Limit on forgot password pageN/AImproper Restriction of Authentication Attempts · medium · UPchieve
    5 votes
31. A password in plain text in conf fileN/APassword in Configuration File · Sifchain
    5 votes
32. No valid SPF record foundN/AImproper Authentication - Generic · Kubernetes
    5 votes
33. AWS S3 Bucket hotornot-images permissions allow for listing and removing filesN/AImproper Authentication - Generic · Bumble
    5 votes
34. netrc credentials leaked to a cross-host redirect target on the Basic auth path (not covered by redirect credential protections)N/AInsufficiently Protected Credentials · medium · curl
    4 votes
35. Autofill/Autosave password on loginN/AInsufficiently Protected Credentials · medium · Yelp
    4 votes
36. No character limit in password fieldN/AUse of Hard-coded Password · medium · UPchieve
    4 votes
37. Insufficient Session ExpirationN/AInsufficient Session Expiration · low · Urban Company
    4 votes
38. Reset Link IssueN/AImproper Authentication - Generic · Gratipay
    4 votes
39. An adversary can overwhelm the resources by automating Forgot password/Sign Up requestsN/AImproper Authentication - Generic · Coinbase
    4 votes
40. Cross-origin redirect reuses a pooled Negotiate-authenticated connection from an unrelated transferN/AImproper Authentication - Generic · medium · curl
    3 votes
41. Windows SSPI connection-pool probe can reuse a connection under the wrong userN/AAuthentication Bypass by Spoofing · medium · curl
    3 votes
42. no rate limit in forgot password sessionN/AImproper Restriction of Authentication Attempts · medium · Yelp
    3 votes
43. The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more suN/AImproper Restriction of Authentication Attempts · medium · LinkedIn
    3 votes
44. Credential leak when use two urlN/AInsufficiently Protected Credentials · medium · curl
    3 votes
45. No rate Limit on Password Reset page on upchieveN/AImproper Restriction of Authentication Attempts · medium · UPchieve
    3 votes
46. Unsecure changing passwordN/AImproper Authentication - Generic · Liberapay
    3 votes
47. Password Complexity N/AImproper Authentication - Generic · Legal Robot
    3 votes
48. Failure to check password historyN/AWeak Password Recovery Mechanism for Forgotten Password · low · WakaTime
    3 votes
49. No Restriction on passwordN/AImproper Authentication - Generic · GitLab
    2 votes
50. Cookie injection from non-secure contextN/ASession Fixation · high · curl
    2 votes
51. No valid SPF record foundN/AImproper Authentication - Generic · Sifchain
    2 votes
52. No Rate Limit in email leads to huge Mass mailingsN/AImproper Restriction of Authentication Attempts · Sifchain
    2 votes
53. Unable to register in starbucks appN/AWeak Cryptography for Passwords · medium · Starbucks
    2 votes
54. User enumeration in wp-adminN/AImproper Authentication - Generic · Ian Dunn
    2 votes
55. set Expires headerN/AImproper Authentication - Generic · Gratipay
    2 votes
56. set Pragma headerN/AImproper Authentication - Generic · Gratipay
    2 votes
57. FTP authentication options leak to a cross-origin FTP redirect with unrestricted auth disabledN/AInsufficiently Protected Credentials · low · curl
    1 votes
58. Session Token in URLN/AImproper Authentication - Generic · Sifchain
    1 votes
59. A specially crafted value for the 'Cache-Digest' header causing crash in chat.makerdao.comN/AImproper Restriction of Authentication Attempts · critical · BlockDev Sp. Z o.o
    1 votes
60. Enforce minimum master password complexityN/APassword in Configuration File · medium · Tor
    1 votes
61. Chat exposed using cookieN/AReliance on Cookies without Validation and Integrity Checking in a Security Decision · Legal Robot
    1 votes