Weak authentication occurs when a system relies on easily defeated verification methods to confirm a user's identity. This might include simple passwords…
Weak authentication occurs when a system relies on easily defeated verification methods to confirm a user's identity. This might include simple passwords, missing multi-factor checks, or insufficient verification of credentials. When authentication is weak, attackers can gain unauthorized access to accounts and sensitive data with minimal effort.
Weak authentication typically arises from one or more of these patterns: accepting overly simple or predictable credentials (e.g., no password complexity requirements), relying on a single factor when multiple factors are feasible, failing to rate-limit or throttle login attempts, storing credentials insecurely, or skipping verification steps that should be mandatory. Developers may also implement custom authentication logic instead of using established, vetted libraries, introducing subtle flaws. The root cause is usually underestimating the importance of authentication or prioritizing convenience over security.
Compromised authentication is a direct path to account takeover. An attacker who defeats weak authentication can impersonate legitimate users, access private data, modify records, perform unauthorized transactions, or escalate privileges to administrative accounts. In multi-user systems, a single weak account can become a foothold for lateral movement. The impact scales with the sensitivity of the data or functions the account controls.
import sqlite3
def authenticate_user(username, password):
conn = sqlite3.connect('users.db')
cursor = conn.cursor()
# Directly comparing plaintext password from input to stored password
cursor.execute(
"SELECT * FROM users WHERE username = ? AND password = ?",
(username, password)
)
user = cursor.fetchone()
conn.close()
return user is not NoneWhy it's vulnerable:
Passwords are stored in plaintext and compared directly, making them trivial to read if the database is compromised. There is no rate-limiting on failed attempts, allowing brute-force attacks.
import sqlite3
import hashlib
import secrets
from functools import wraps
from time import time
def authenticate_user(username, password, max_attempts=5, lockout_duration=300):
conn = sqlite3.connect('users.db')
cursor = conn.cursor()
# Check for account lockout
cursor.execute(
"SELECT failed_attempts, last_failed_time FROM users WHERE username = ?",
(username,)
)
result = cursor.fetchone()
if result and result[0] >= max_attempts:
if time() - result[1] < lockout_duration:
conn.close()
return False
# Retrieve stored hash and salt
cursor.execute(
"SELECT password_hash, salt FROM users WHERE username = ?",
(username,)
)
user = cursor.fetchone()
conn.close()
if not user:
return False
stored_hash, salt = user
# Hash the provided password with the stored salt
provided_hash = hashlib.pbkdf2_hmac(
'sha256', password.encode(), salt, 100000
)
if provided_hash.hex() == stored_hash:
# Reset failed attempts on success
conn = sqlite3.connect('users.db')
cursor = conn.cursor()
cursor.execute(
"UPDATE users SET failed_attempts = 0 WHERE username = ?",
(username,)
)
conn.commit()
conn.close()
return True
else:
# Increment failed attempts
conn = sqlite3.connect('users.db')
cursor = conn.cursor()
cursor.execute(
"UPDATE users SET failed_attempts = failed_attempts + 1, last_failed_time = ? WHERE username = ?",
(time(), username)
)
conn.commit()
conn.close()
return False<?php
// Weak authentication: plaintext password comparison
$username = $_POST['username'];
$password = $_POST['password'];
$conn = new mysqli('localhost', 'user', 'pass', 'mydb');
$result = $conn->query(
"SELECT * FROM users WHERE username = '$username' AND password = '$password'"
);
if ($result->num_rows > 0) {
$_SESSION['authenticated'] = true;
echo "Login successful";
} else {
echo "Invalid credentials";
}
?>Why it's vulnerable:
Passwords are stored and compared in plaintext, and there is no protection against SQL injection or brute-force attacks. No rate-limiting or account lockout mechanism exists.
<?php
// Strong authentication with hashing, rate-limiting, and prepared statements
$username = $_POST['username'] ?? '';
$password = $_POST['password'] ?? '';
$max_attempts = 5;
$lockout_duration = 300; // seconds
$conn = new mysqli('localhost', 'user', 'pass', 'mydb');
// Check for account lockout
$stmt = $conn->prepare(
"SELECT failed_attempts, last_failed_time FROM users WHERE username = ?"
);
$stmt->bind_param('s', $username);
$stmt->execute();
$result = $stmt->get_result();
$user_status = $result->fetch_assoc();
if ($user_status && $user_status['failed_attempts'] >= $max_attempts) {
if (time() - $user_status['last_failed_time'] < $lockout_duration) {
echo "Account temporarily locked. Try again later.";
exit;
}
}
// Retrieve password hash using prepared statement
$stmt = $conn->prepare("SELECT id, password_hash FROM users WHERE username = ?");
$stmt->bind_param('s', $username);
$stmt->execute();
$result = $stmt->get_result();
$user = $result->fetch_assoc();
if ($user && password_verify($password, $user['password_hash'])) {
// Reset failed attempts on success
$stmt = $conn->prepare("UPDATE users SET failed_attempts = 0 WHERE id = ?");
$stmt->bind_param('i', $user['id']);
$stmt->execute();
$_SESSION['authenticated'] = true;
$_SESSION['user_id'] = $user['id'];
echo "Login successful";
} else {
// Increment failed attempts
$stmt = $conn->prepare(
"UPDATE users SET failed_attempts = failed_attempts + 1, last_failed_time = ? WHERE username = ?"
);
$now = time();
$stmt->bind_param('is', $now, $username);
$stmt->execute();
echo "Invalid credentials";
}
?>bcrypt, scrypt, or PBKDF2 with a unique salt per user; never store plaintext passwords.
Monitor your authentication logs for patterns such as a high volume of failed login attempts from a single IP address, successful logins from unexpected geographic locations or times, or new administrative accounts you did not create. If you discover plaintext passwords in your database backups or logs, or if users report unauthorized account access, weak authentication may be the root cause.
