Browse / Authentication

Authentication

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Improper Authentication - Generic955
• Improper Restriction of Authentication Attempts159
• Insufficiently Protected Credentials43
• Insufficient Session Expiration43
• Authentication Bypass Using an Alternate Path or Channel28
• Authentication Bypass by Primary Weakness19
• Session Fixation15
• Use of Hard-coded Credentials13
• Weak Password Recovery Mechanism for Forgotten Password11
• Plaintext Storage of a Password11
• Weak Cryptography for Passwords11
• Password in Configuration File9
• Missing Authentication for Critical Function8
• Reliance on Cookies without Validation and Integrity Checking in a Security Decision8
• Authentication Bypass6
• Unverified Password Change5
• Storing Passwords in a Recoverable Format4
• Missing Critical Step in Authentication3
• Use of Hard-coded Password3
• Use of Default Credentials2
• Key Exchange without Entity Authentication2
• Authentication Bypass by Spoofing2
• Brute Force2
• Weak Password Requirements1
• Authentication Bypass by Capture-replay1
• Unprotected Transport of Credentials1

Often found together with

• Access Control179
• Misconfiguration153
• Information Disclosure132
• Cross-site Scripting125
• Cross-Site Request Forgery79
• Insecure Direct Object Reference43
• Denial of Service35

Most upvoted Authentication reports

AllValidInformativeN/ADuplicate

1. Account takeover via leaked session cookieInsufficiently Protected Credentials · high · HackerOne
   $20,0001,642 votes
2. Github access token exposureImproper Authentication - Generic · critical · Shopify
   $50,0001,601 votes
3. Token leak in security challenge flow allows retrieving victim's PayPal email and plain text passwordMissing Authentication for Critical Function · high · PayPal
   $15,3001,409 votes
4. Improper Authentication - any user can login as other user with otp/logout & otp/loginImproper Authentication - Generic · critical · Snapchat
   972 votes
5. Subdomain Takeover to Authentication bypass Improper Authentication - Generic · critical · Roblox
   783 votes
6. JumpCloud API Key leaked via Open Github Repository.Use of Hard-coded Credentials · critical · Starbucks
   739 votes
7. Bypassing Digits origin validation which leads to account takeoverImproper Authentication - Generic · X / xAI
   619 votes
8. Flickr Account Takeover using AWS Cognito APIImproper Authentication - Generic · critical · Flickr
   440 votes
9. Chained Bugs to Leak Victim's Uber's FB Oauth TokenImproper Authentication - Generic · high · Uber
   427 votes
10. [cs.money] Open Redirect Leads to Account TakeoverImproper Authentication - Generic · medium · CS Money
    357 votes
11. Reset any passwordWeak Password Recovery Mechanism for Forgotten Password · high · pixiv
    313 votes
12. Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical)Improper Authentication - Generic · Uber
    312 votes
13. Bypass Password Authentication for updating email and phone number - Security VulnerabilityImproper Authentication - Generic · high · X / xAI
    288 votes
14. Insufficient OAuth callback validation which leads to Periscope account takeoverImproper Authentication - Generic · X / xAI
    277 votes
15. Insufficient validation on Digits bridgeImproper Authentication - Generic · X / xAI
    263 votes
16. Ability to DOS any organization's SSO and open up the door to account takeoversImproper Authentication - Generic · high · Superhuman (formerly Grammarly)
    $10,500260 votes
17. Ability to bypass email verification for OAuth grants results in accounts takeovers on 3rd partiesAuthentication Bypass Using an Alternate Path or Channel · high · GitLab
    $3,000257 votes
18. Mass Account Takeover at https://app.taxjar.com/ - No user InteractionAuthentication Bypass Using an Alternate Path or Channel · critical · Stripe
    253 votes
19. Improper Validation at Partners LoginImproper Authentication - Generic · critical · Eternal
    $2,000251 votes
20. Stealing SSO Login Tokens (snappublisher.snapchat.com)Authentication Bypass · high · Snapchat
    $7,500244 votes
21. Incorrect authorization to the intelbot service leading to ticket informationImproper Authentication - Generic · critical · TikTok
    $15,000219 votes
22. HackerOne Jira integration plugin Leaked JWT to unauthorized jira usersImproper Authentication - Generic · medium · HackerOne
    $3,000213 votes
23. Mass Accounts Takeover Without any user Interaction at https://app.taxjar.com/ Authentication Bypass Using an Alternate Path or Channel · high · Stripe
    212 votes
24. 2FA Bypass leads to impersonation of legimate usersImproper Authentication - Generic · high · Drugs.com
    207 votes
25. H1514 [*.(my)shopify.com] - Viewing Password Protected ContentImproper Authentication - Generic · critical · Shopify
    $3,000192 votes
26. Authentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.comImproper Authentication - Generic · critical · Uber
    183 votes
27. GraphQL AdminGenerateSessionPayload is leaked to staff with no permissionImproper Authentication - Generic · medium · Shopify
    173 votes
28. Account Takeover via Authentication Bypass in TikTok Account RecoveryAuthentication Bypass Using an Alternate Path or Channel · critical · TikTok
    $12,000172 votes
29. Web Authentication Endpoint Credentials Brute-Force VulnerabilityImproper Authentication - Generic · HackerOne
    161 votes
30. Session works after logout from Shopify account and password of online store is displayedImproper Authentication - Generic · low · Shopify
    157 votes
31. Absence of Token expiry leads to Unauthorized login AccessImproper Authentication - Generic · critical · Affirm
    155 votes
32. h1-202 leaderboard photo discloses local wifi password Insufficiently Protected Credentials · medium · HackerOne
    145 votes
33. H1514 Session Fixation on multiple shopify-built apps on *.shopifycloud.com and *.shopifyapps.comSession Fixation · Shopify
    144 votes
34. Open Redirect on central.uber.com allows for account takeoverImproper Authentication - Generic · high · Uber
    144 votes
35. Attacker can obtain write access to any federated share/public linkImproper Authentication - Generic · high · Nextcloud
    $4,000142 votes
36. Reading Emails in Uber SubdomainsImproper Authentication - Generic · Uber
    141 votes
37. Mint Oauth2 access token for targeted userImproper Authentication - Generic · high · GitLab
    $5,580140 votes
38. Yet Another OTP code Leaked in the API ResponseImproper Authentication - Generic · critical · MTN Group
    135 votes
39. total Failure of password protection while extracting seed phrase! increases attack surface area for scammersAuthentication Bypass Using an Alternate Path or Channel · medium · MetaMask
    $3,500131 votes
40. Improper bot-authentication allows to impersonate any user when sending messages in a roomImproper Authentication - Generic · high · Basecamp
    $2,000128 votes
41. Incorrect param parsing in Digits web authenticationImproper Authentication - Generic · X / xAI
    126 votes
42. User can upload files even after closing his accountImproper Authentication - Generic · Basecamp
    124 votes
43. FULL ACCOUNT TAKEOVERImproper Authentication - Generic · critical · MTN Group
    123 votes
44. Critical full compromise of jarvis-new.urbanclap.com via weak session signingImproper Authentication - Generic · critical · Urban Company
    $1,500123 votes
45. MySQL username and password leaked in developer.valvesoftware.com via source code dislosurePassword in Configuration File · medium · Valve
    123 votes
46. HackerOne Code sends live password-reset tokens to Segment in automatic page eventsInsufficiently Protected Credentials · low · HackerOne
    $200115 votes
47. Account Takeover Vulnerability in Shopify Collabs Platform Due to Missing Email VerificationImproper Authentication - Generic · low · Shopify
    $800112 votes
48. Lack of Rate Limiting on Account Creation Endpoint Improper Restriction of Authentication Attempts · low · XVIDEOS
    $200110 votes
49. Able to steal bearer token from deep linkImproper Authentication - Generic · high · Basecamp
    $6,337110 votes
50. Ability to join an arbitrary workspace by utilizing a proxy to manipulate invite linksImproper Authentication - Generic · critical · Slack
    109 votes
51. Authentication Bypass Leads To Complete Account TakeveOver on ██████████Authentication Bypass Using an Alternate Path or Channel · critical · MTN Group
    109 votes
52. Bypassing Digits web authentication's host validation with HPPImproper Authentication - Generic · X / xAI
    108 votes
53. Rate limit bypass on passport.acronis.work using X-Forwarded-For request headerImproper Restriction of Authentication Attempts · medium · Acronis
    106 votes
54. Admin Authentication Bypass Lead to Admin Account Takeover Improper Authentication - Generic · medium · UPS VDP
    106 votes
55. Account Takeover in Password Reset FunctionAuthentication Bypass · critical · Mars
    105 votes
56. Staging Rabbitmq instance is exposed to the internet with default credentialsImproper Authentication - Generic · low · Unikrn
    105 votes
57. Lack of rate limitation on careers site allows the attacker to brute force the verification codeImproper Restriction of Authentication Attempts · high · TikTok
    104 votes
58. Leak ██████████ information in real time through API requestImproper Authentication - Generic · high · Grab
    $3,000103 votes
59. Login to any account with the emailaddressImproper Authentication - Generic · high · Eternal
    $1,000103 votes
60. Bypass a fix for report #708013Improper Restriction of Authentication Attempts · medium · Shopify
    $3,500102 votes
61. Insecure Zendesk SSO implementation by generating JWT client-sidePassword in Configuration File · high · Trint Ltd
    102 votes
62. PIN bypass in PassCodeActivity via back buttonImproper Authentication - Generic · medium · Nextcloud
    $150101 votes
63. Email OTP/2FA BypassImproper Authentication - Generic · critical · Drugs.com
    100 votes
64. password reset token leaking allowed for ATO of an Uber accountImproper Authentication - Generic · critical · Uber
    $10,000100 votes
65. Ability to Add and Verify Uncontrolled Mobile Numbers Leading to Account Takeover (ATO)Authentication Bypass Using an Alternate Path or Channel · critical · MTN Group
    98 votes
66. JWT audience claim is not verifiedMissing Critical Step in Authentication · critical · Internet Bug Bounty
    98 votes
67. Important information leaked on GithubUse of Hard-coded Credentials · high · Equifax-vdp
    98 votes
68. 2FA bypass possible on https://authsvc.singlestore.comAuthentication Bypass · medium · SingleStore
    96 votes
69. Attacker can get vine repost user all informations even Ip address and location .Improper Authentication - Generic · X / xAI
    95 votes
70. returnUrl= allow attacker to redirect users to the another phising website and takeover credientialsImproper Authentication - Generic · medium · Insightly
    94 votes
71. Account Takeover via SMS Authentication Flow Improper Authentication - Generic · high · Zenly
    94 votes
72. POST /api/bitcoinWithdrawalFees returns financial data without authentication despite being documented as a USER OPERATION (private endpoint)Improper Authentication - Generic · medium · CoinMate.io
    93 votes
73. Out of scope: Improper Input Validation Order on /api-internal/login via password field leads to unnecessary resource consumptionImproper Authentication - Generic · low · PortSwigger Web Security
    $20092 votes
74. Account takeover w/o interaction for a user that doesn't have 2fa enabled via 2fa linking and improper auth at /api/2fa/verifyImproper Authentication - Generic · medium · Helium
    92 votes
75. Unauthenticated Docker registryImproper Authentication - Generic · Imgur
    92 votes
76. Bypassing Digits bridge origin validationImproper Authentication - Generic · X / xAI
    92 votes
77. Full Admin Takeover of R3 Limited's JFrog Artifactory - 292 Users, Corda Enterprise & CBDC Supply Chain CompromisedImproper Authentication - Generic · critical · R3
    91 votes
78. Bypass of biometrics security functionality is possible in Android application (com.shopify.mobile)Improper Authentication - Generic · low · Shopify
    $50090 votes
79. [CRITICAL] -- Complete Account TakeoverImproper Authentication - Generic · Uber
    $8,00089 votes
80. Many Slack teams can be joined by abusing an improperly configured support@ inboxImproper Authentication - Generic · Slack
    88 votes
81. SAML Authentication Bypass on uchat.uberinternal.comImproper Authentication - Generic · high · Uber
    $8,50088 votes
82. No Session Expiry after log-out, attacker can reuse the old cookiesInsufficient Session Expiration · low · Shopify
    $50087 votes
83. Password Reset Link not expiring after changing the email Leads To Account TakeoverImproper Authentication - Generic · medium · Imgur
    87 votes
84. PIN 📌 BYPASS 🥷Improper Authentication - Generic · high · Yoti
    84 votes
85. [Studio.twitter.com] See someone else pics Improper Authentication - Generic · X / xAI
    84 votes
86. Access to internal CMS containing private DataImproper Authentication - Generic · Yelp
    83 votes
87. “email” MFA mode allows bypassing MFA from victim’s device when the device trust is not expiredImproper Authentication - Generic · medium · Superhuman (formerly Grammarly)
    $2,50082 votes
88. Unauthorized access to GovSlackImproper Authentication - Generic · medium · Slack
    $1,50081 votes
89. Account takeover via Google OneTapImproper Authentication - Generic · high · Priceline
    81 votes
90. Forced OAuth authorization using button ID in hash and holding spaceImproper Authentication - Generic · medium · LinkedIn
    79 votes
91. Cookie steal through content UriWeak Password Recovery Mechanism for Forgotten Password · critical · Brave Software
    79 votes
92. Improper Authentication Allows Making Appeals as Other UsersImproper Authentication - Generic · medium · U.S. Dept Of Defense
    77 votes
93. default credentials at https://52.42.105.71/Improper Authentication - Generic · critical · Trellix
    77 votes
94. Near to Infinite loop when changing Group's name that has API token as Team MemberImproper Authentication - Generic · medium · HackerOne
    $2,50077 votes
95. Unauthenticated GraphQL access by prepending __schema to private operationsAuthentication Bypass · medium · Enjin
    $50076 votes
96. Login to any user account using other facebook app access token Improper Authentication - Generic · Imgur
    76 votes
97. Authentication Bypass to (CVE-2023-2982)Authentication Bypass Using an Alternate Path or Channel · low · CS Money
    $10074 votes
98. No length on passwordWeak Password Recovery Mechanism for Forgotten Password · medium · Imgur
    74 votes
99. Отправка писем с произвольным текстом/кликабельными ссылками любому зарегистрированному пользователю с указанной почтой, зная только steamidReliance on Cookies without Validation and Integrity Checking in a Security Decision · critical · CS Money
    74 votes
100. 明確な認証不備および潜在的な中間者攻撃の可能性（Clear Authentication Deficiencies & Potential for Man-in-the-Middle Attacks）Key Exchange without Entity Authentication · high · Sony
     71 votes