Authentication Weaknesses
High · Authentication
OWASP Top 10:2025 (current)
A07:2025 — Authentication Failures
Historical Top 10:2021 (not current)
A07:2021 — kept for older reports; use 2025 above.
CWE
CWE-287
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
OWASP A07:2025 · OWASP A07:2021 · CWE-287
Definition
Weak login, password and session mechanisms.
Root cause
No rate limiting, weak passwords, no MFA.
Affected components
- Login
- Password reset
- Session cookies
- MFA enrollment
Impact
Account takeover.
Severity
High
Safe lab reproduction
DVWA Brute Force module
Detection methodology
Failed-login spikes in logs.
Evidence examples
- No rate limit on lab login
- Session fixation notes
Remediation
MFA, rate limiting, strong password policies.
Secure coding examples
Use proven auth libraries; hash with Argon2/bcrypt.
Related CYNARKS lessons & labs
Primary 2025 class: A07:2025 — Authentication Failures
Practise related skills in Labs or deepen on Academy library.