Broken Authentication

Flawed session or credential handling that lets attackers assume other users' identities.

Specifications & Metrics

cwe

CWE-287

impact

Critical

Core Principles & Analysis

• Covers weak passwords, missing rate limits, and session tokens that never expire.
• Credential stuffing works best against sites without multi-factor defences.
• Consistently in the OWASP Top 10 under its current and earlier names.