🔑 Useless if the lock is flimsy! OWASP #7, Unpacking Identification and Authentication Failures

Nov 1, 2026

—

Hello! 👋 In our OWASP Top 10 Conquest series, today we’ll explore A07:2021-Identification and Authentication Failures, which was more comprehensively renamed from “Broken Authentication” in 2017.

What if your front door has a sturdy lock, but that lock is too common (easy password), or your key bundle is exposed to anyone? 😱 Similarly, ‘Identification and Authentication Failures’ is a vulnerability that occurs due to flaws in the process of confirming who a user is (identification) and verifying that identity (authentication). Let’s check together how robust our service’s first gateway, the login system, is! 🕵️‍♀️

🤔 Identification and Authentication Failures? What are they?

“Problems in the process of confirming who you are and if it’s really you” 👥➡️❓

Identification and Authentication Failures are security issues that arise when an application fails to properly verify a user’s identity (Identification), or when the mechanism for verifying identity (Authentication) is weak or improperly implemented. Simply put, it includes all situations where the system cannot be sure “if the person trying to log in is really that person.”

This vulnerability is extremely critical because it can allow attackers to steal legitimate user accounts (ID, password) or even bypass the login process entirely to gain access to the system. Once an account is compromised, the attacker can perform all operations with the privileges of that user.

🕵️‍♂️ Common Examples of Identification and Authentication Failures

In what cases can identification and authentication be said to have ‘failed’?

1. Weak or Predictable Passwords 🔑

The most basic, and most common problem.

Problem: This occurs when a service allows users to use easy or common passwords such as password123, 123456, qwerty. Attackers can easily guess these passwords through dictionary attacks or brute-force attacks and compromise accounts.
Example: Lack of or weak complexity policies for passwords, such as minimum length, uppercase/lowercase letters, numbers, and special character combinations.

2. Inadequate Password Reset/Recovery Mechanisms 🔄

The convenience of password recovery can sometimes be a poison.

Problem: “Password hint” questions are too easy (e.g., ‘What is your mother’s maiden name?’), allowing attackers to deduce answers through publicly available information (e.g., SNS) and attempt account takeover. Or, password reset links are too easily predictable or have no expiration date.
Example: When resetting a password, an email can be sent using only the user ID, and a ‘success’ message is shown without verifying the email address. (Exposing account existence)

3. Session Management Vulnerabilities 👻

Must be secure even after login.

Problem: When login is successful, a session token is issued to the user. If this token is short or predictable, attackers can steal or forge it. Or, if the session is not properly invalidated upon logout, attackers can maintain a logged-in state with a stolen session.
Example: Session IDs exposed in URLs, or session cookies being stolen via XSS attacks due to lack of HttpOnly and Secure attributes.

4. Absence or Weakness of Multi-Factor Authentication (MFA) 📱

One key is not enough.

Problem: Important accounts do not have Multi-Factor Authentication (MFA) applied, or even if applied, MFA codes can be attempted an unlimited number of times.
Example: A feature that sends a 2-factor authentication code via SMS, but allows unlimited attempts even if the code is entered incorrectly multiple times, making it vulnerable to brute-force attacks.

5. Absence of Account Lockout and Rate Limiting 🚫

Unlimited attempts will eventually succeed.

Problem: Lack of features to lock accounts after a certain number of failed login attempts or to limit the number of login attempts within a specific time (Rate Limiting). Attackers can exploit this to endlessly guess login information or discover existing accounts.
Example: On a login page, an account is not locked or an IP address is not blocked even after 1 million password attempts for a specific ID.

🛡️ How can we prevent it? (Defense Methods)

Identification and authentication failures are the first gateway of a service, so they must be built with the utmost robustness.

Enforce Strong Password Policies 🔐:

Minimum length, uppercase/lowercase letters, numbers, special character combinations, etc., complexity requirements must be set and enforced.
Prohibit the use of passwords found in leaked password lists (e.g., HaveIBeenPwned API).
Passwords must be stored using strong hashing algorithms with salt (e.g., Bcrypt, Argon2).

Implement Multi-Factor Authentication (MFA) 📱✔️: Mandate or strongly recommend MFA for all important accounts where possible. (e.g., OTP, SMS authentication, biometric authentication)
Apply Account Lockout and Rate Limiting 🚫⏰:

Lock accounts after a certain number of failed login attempts, or limit login attempts for that IP address/user for a certain period.
To avoid exposing information such as “user ID does not exist,” always show a generic error message (“Incorrect ID or password.”) on login failure.

Secure Session Management 🍪:

Session IDs must be unpredictable and highly random values.
Set Secure and HttpOnly flags on session cookies to prevent theft via XSS, etc.
Immediately invalidate sessions upon logout and set appropriate session expiration times.

Strengthen Password Reset/Recovery Mechanisms 🔒➡️✉️:

Reset links must be one-time use and have a short validity period.
Avoid “security questions” that users can easily guess.
When authenticating via email or SMS, apply rate limiting to prevent unlimited attempts.

✨ Conclusion

Identification and authentication failures are extremely critical vulnerabilities that can be the starting point for all attacks. No matter how excellent our service is, if the first gateway is flimsy, everything becomes useless. It is essential to design and implement strong authentication mechanisms from the early stages of development, and to continuously review and improve them.

Let’s make our service’s front door sturdy and manage keys thoroughly to prevent hacker intrusions! 🏡💪

Tags: OWASP, A07, Authentication Failures, Identification, Authentication, Password Security, MFA, Session Management, Account Takeover