Broken authentication

What it means

Broken authentication is a family of flaws in how an application proves who someone is. The weakness can be in the sign-in form, the password reset, the session cookie or the token. The result is the same: a person can act as an account that is not theirs.

OWASP lists it as a top risk for both web applications and APIs. It is not one bug. It covers weak passwords being accepted, endless guessing, tokens that can be forged or reused, and sessions that do not end when they should.

Why it matters

Once an attacker holds a real account, every control behind the sign-in works in their favour. They can read the customer's data, spend their credit and send messages in their name. If the account is an administrator, the damage covers the whole business.

These flaws also make account takeover cheap at scale. Automated tools try stolen passwords against thousands of accounts. The cost to you is support load, fraud, refunds and customers who stop trusting you with their data, plus the awkward conversation about how long it went unnoticed.

How it shows up

Typical causes are easy to list. There may be no limit on guessing, so brute force or credential stuffing succeeds. There may be a password reset flaw, session identifiers that do not change after sign-in, tokens with no expiry, or unsigned and weakly verified JWTs.

Check how sign-in behaves under repetition, what the reset link proves, whether the session survives logout, and whether the server validates every token field. Test the less visible routes too: mobile APIs, legacy endpoints and the support tools that let staff reset access. Support tooling is often built quickly, trusted heavily and tested rarely.