A07: Authentication Failures · 2025

Weak identity, credential or session controls allow impersonation and account takeover

Summary

Weak identity, credential or session controls allow impersonation and account takeover. Risks include insecure recovery, poorly managed sessions and missing defenses against automated attacks.

How the attack works

An attacker tries stolen credentials at a login with no attempt limits or second factor and takes over an account.

Example

Vulnerable · Pseudocode

login:
  rate_limit: off
  mfa: disabled

Fix: Limit attempts by account and source; require MFA.

Prevention

Adopt multifactor authentication and secure credential policies.
Protect sessions, rotate identifiers and terminate sessions reliably.
Limit attempts, detect compromised credentials and avoid default accounts.

Lineage

2013 · A2: Broken Authentication and Session Management Renamed in 2017
2017 · A2: Broken Authentication Renamed and moves down in 2021
2021 · A07: Identification and Authentication Failures Renamed from A2:2017
2025 · A07: Authentication Failures Simplified name

2013:A2 → 2017:A2: The name is simplified and retains rank 2.
2017:A2 → 2021:A07: Broken Authentication expands its scope and is renamed.
2021:A07 → 2025:A07: The name is simplified to Authentication Failures.

Sources

Open official source ↗

Buy me a coffee