Broken Authentication

CriticalIdentity & AccessA07:2021 – Identification and Authentication Failures

Weaknesses in authentication mechanisms allow attackers to compromise passwords, session tokens, or exploit flawed implementation to assume other users' identities.

Immediate Response

1Force a global session invalidation and require all users to re-authenticate.
2Block or rate-limit IP addresses showing brute-force patterns.
3Audit recent authentication logs for compromised accounts.
4Notify impacted users and guide them to change credentials immediately.

All playbooks

1Enforce multi-factor authentication (MFA) for all accounts, especially privileged ones.
2Implement account lockout policies (e.g., 5 failed attempts triggers temporary lock).
3Use cryptographically secure, sufficiently long random session tokens.
4Store passwords with a strong adaptive algorithm: bcrypt, Argon2, or PBKDF2.

Long-term Prevention

1Adopt a well-maintained identity provider or authentication framework rather than rolling your own.
2Implement breached password detection (e.g., HaveIBeenPwned API integration).
3Monitor authentication anomalies with behavioral analytics.
4Conduct regular penetration tests targeting authentication workflows.

Attack vectors

Brute-force and credential stuffing against login endpoints
Predictable or non-expiring session tokens
Insecure password reset flows with guessable tokens
Plaintext or weakly hashed password storage

Indicators of compromise

High volume of failed login attempts from a single IP or distributed IPs
Successful logins from geographically impossible locations
Password reset tokens appearing in access logs or referrer headers
Multiple accounts accessed from the same session fingerprint

Tooling

OWASP ASVSAuth0KeycloakHaveIBeenPwned APIFail2Ban