Authentication Failures
2025 shortens the 2021 name 'Identification and Authentication Failures'. Session issuance, reset, MFA, and logout. The question is whether the server binds the next session to the person who proved identity.
OWASP rank: 7
Practical checks
- Map register, login, reset, MFA, remember-me, and logout as one state machine
- Check reset links for host confusion and token reuse on accounts you own
- See whether logout revokes the refresh token or only clears the browser
- Note MFA that can be skipped by an older session or a backup endpoint
- Do not spray credentials. Rate-limit evidence is a single controlled observation