Broken Authentication

Broken authentication encompasses implementation flaws in authentication and session management that allow attackers to compromise passwords, keys, or session tokens. Common issues include weak password policies, missing brute force protections, insecure session fixation, and improper credential storage.

OWASP recommends multi-factor authentication, secure session management, and credential breach detection as primary controls.