A2: Broken Authentication and Session Management · 2013
Weak identity, credential or session controls allow impersonation and account takeover
Summary
Weak identity, credential or session controls allow impersonation and account takeover. Risks include insecure recovery, poorly managed sessions and missing defenses against automated attacks.
How the attack works
Login retains a session identifier known before authentication; an attacker can reuse that session.
Example
Vulnerable · PseudocodePOST /login
Cookie: session=known-id
reuse_session_id()Fix: Rotate the identifier on authentication, invalidate the old session and secure cookies and logout.
Prevention
- Adopt multifactor authentication and secure credential policies.
- Protect sessions, rotate identifiers and terminate sessions reliably.
- Limit attempts, detect compromised credentials and avoid default accounts.
Lineage
- 2013 · A2: Broken Authentication and Session Management Renamed in 2017
- 2017 · A2: Broken Authentication Renamed and moves down in 2021
- 2021 · A07: Identification and Authentication Failures Renamed from A2:2017
- 2025 · A07: Authentication Failures Simplified name
- 2013:A2 → 2017:A2: The name is simplified and retains rank 2.
- 2017:A2 → 2021:A07: Broken Authentication expands its scope and is renamed.
- 2021:A07 → 2025:A07: The name is simplified to Authentication Failures.