Broken Authentication/ Broken User Authentication (BUA)
Broken Authentication/ Broken User Authentication (BUA)
A flaw allowing an attacker to assume other users’ identities temporarily or permanently by compromising passwords, keys, or session tokens. One should look for:
- Missing authentication.
- Storing passwords in plaintext, or other poorly maintained forms.
- Poor session management.
- Permits brute force or other automated attacks.
- Weak credential recovery processes.
- Missing or ineffective multi-factor authentication.
