Improper authentication occurs when software fails to adequately verify that a user is who they claim to be. Instead of properly validating credentials, the…
Improper authentication occurs when software fails to adequately verify that a user is who they claim to be. Instead of properly validating credentials, the system may skip checks, accept weak proof, or trust unverified claims — allowing an attacker to impersonate legitimate users. This is one of the most common and dangerous weaknesses in web applications.
Authentication weaknesses arise when developers either omit identity verification entirely or implement it in a way that can be bypassed. Common patterns include: checking only a username without a password, accepting credentials from an untrusted source (like a client-side cookie or URL parameter) without server-side validation, failing to hash or properly secure stored passwords, or trusting a single weak factor (like an email address) as proof of identity. The root cause is usually a misunderstanding of the trust boundary — treating client-supplied data as proof rather than as a claim that must be verified against a secure server-side record.
Successful authentication bypass allows attackers to access accounts they do not own, steal sensitive data, modify records, perform unauthorized transactions, or escalate privileges. In multi-user systems, a single authentication flaw can compromise all users. For financial, healthcare, or government applications, the impact extends to fraud, privacy violations, and regulatory penalties. Even in lower-risk contexts, authentication failure erodes user trust and can lead to widespread account takeovers.
def login(username, password):
user = database.query("SELECT * FROM users WHERE username = ?", username)
if user:
return {"authenticated": True, "user_id": user.id}
return {"authenticated": False}Why it's vulnerable:
The function accepts a username and completely ignores the password parameter. Any attacker who knows a valid username can log in as that user without providing the correct password.
import hashlib
import secrets
def login(username, password):
user = database.query("SELECT * FROM users WHERE username = ?", username)
if user and verify_password(password, user.password_hash):
return {"authenticated": True, "user_id": user.id}
return {"authenticated": False}
def verify_password(plain_password, stored_hash):
return hashlib.pbkdf2_hmac('sha256', plain_password.encode(),
stored_hash[:32], 100000) == stored_hash[32:]<?php
if (isset($_GET['username'])) {
$user = $wpdb->get_row("SELECT * FROM users WHERE user_login = '" . $_GET['username'] . "'");
if ($user) {
$_SESSION['user_id'] = $user->ID;
echo "Logged in as " . $user->user_login;
}
}
?>Why it's vulnerable:
The code logs in any user based solely on a username supplied in the URL query string, with no password check and no server-side session validation. An attacker can simply visit ?username=admin to assume any identity.
<?php
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['username'], $_POST['password'])) {
$user = $wpdb->get_row($wpdb->prepare(
"SELECT * FROM users WHERE user_login = %s",
$_POST['username']
));
if ($user && wp_check_password($_POST['password'], $user->user_pass)) {
wp_set_current_user($user->ID);
wp_set_auth_cookie($user->ID);
wp_safe_remote_post(admin_url('admin-ajax.php'), ['blocking' => false]);
}
}
?>Check your application logs for successful logins from unexpected IP addresses, unusual geographic locations, or at odd hours. Look for accounts with creation dates you don't recognize, or password changes you didn't authorize. If you can log in as another user by simply changing a URL parameter or cookie value without re-entering credentials, your authentication is broken.
