Broken Authentication, also called Broken User Authentication, refers to weaknesses in how an application verifies the identity of its users – flaws that allow attackers to compromise passwords, keys, session tokens, or the authentication process itself, and thereby impersonate legitimate users. Authentication is the gate that confirms a user is who they claim to be; when that gate is broken, an attacker can walk through as someone else, undermining the security of everything behind it.
This is one of the most serious categories of vulnerability and appears prominently in the OWASP API Security Top 10. Because authentication protects access to all functionality and data, compromising it often leads to complete account takeover or system compromise. Attackers exploit broken authentication to assume other users’ identities temporarily or permanently.
Common weaknesses include allowing weak or default passwords, failing to protect against credential stuffing and brute-force attacks (no rate limiting or lockout on login attempts), improperly implementing or validating tokens (such as JWTs), exposing session identifiers, failing to expire or rotate sessions and tokens, transmitting credentials insecurely, weak or missing multi-factor authentication, and flawed password-reset or recovery flows that attackers can abuse. In APIs specifically, authentication endpoints are attractive high-value targets, and misimplemented token handling is a frequent culprit.
The impact of broken authentication is far-reaching: unauthorized access, data theft, fraud, and the ability to use one compromised identity as a foothold for deeper attacks. Prevention requires strong, standards-based authentication: enforcing strong credentials, adding multi-factor authentication, rate-limiting and monitoring authentication attempts, using well-vetted token and session management with proper expiration and revocation, protecting all credential flows in transit, and hardening password-reset processes. Because authentication is foundational, getting it right is essential – a single broken authentication flaw can nullify all other security controls.