OWASP A07 · LAB ENVIRONMENT

Authentication Failures

Authentication Failures happen when login systems don’t verify identity strongly enough — weak password policies, no multi-factor authentication, and no defense against automated credential stuffing let attackers walk right in. Try the interactive playground below to watch a credential-stuffing attack succeed against an unprotected login, then see MFA and lockout stop it.

OWASP Top 10 · 2025 · A07 — Authentication Failures

Credential Stuffing: When Login Pages Trust Passwords Alone

Authentication failures happen when an application can’t reliably confirm that a user is who they claim to be — weak or default credentials, missing multi-factor authentication (MFA), and no protection against automated guessing all leave the door open. Attackers don’t need to “hack” anything clever: they replay huge lists of passwords leaked from other breaches against your login form until one works. Below, attack the same fake login endpoint twice — once undefended, once with modern controls enabled — and watch what changes.

Interactive Demo

Target: employee-portal.corp/login Fixed username: j.smith Wordlist: 20 leaked/common passwords

MFA + Lockout: OFF

Attempt0 / 20

ModeVulnerable (no MFA)

Attack statusIdle

// waiting to launch attack — click “Start credential stuffing attack”

Vulnerable vs. Secure Configuration

✕ Vulnerable — employee-portal.corp (before)

POST /api/login
- No MFA required, ever
- No account lockout / rate limiting
- No breached-password check
- No anomaly / impossible-travel detection
- Unlimited retries from any IP
- "Invalid username or password"
  reveals which field was wrong

✓ Secure — employee-portal.corp (after)

POST /api/login
+ MFA required (TOTP / WebAuthn)
+ Lockout after 5 failed attempts
  (exponential backoff)
+ New/changed passwords checked
  against known-breached lists
+ Impossible-travel & anomaly
  detection on login patterns
+ Per-IP and per-account rate limits
+ Generic "invalid credentials" message

Why This Matters

Billions of username/password pairs from past breaches circulate publicly. Attackers routinely replay these credential lists — plus small tweaked variants — against every login page they can find, betting that people reuse passwords across sites. A login form with no MFA and no lockout can be fully automated against in minutes.

How to Detect & Fix

Require MFA for all accounts, and enforce it without exception for privileged/admin accounts.
Enforce account lockout, throttling, or exponential backoff after a small number of failed login attempts.
Check new and existing passwords against known-breached password lists at signup and reset time.
Monitor logins for anomalous patterns — impossible travel, new devices, unusual login velocity — and challenge or alert on them.
Return generic “invalid credentials” errors so attackers can’t enumerate valid usernames.