Broken Authentication

high

broken-authentication

Weak authentication mechanisms allow attackers to compromise user accounts

Spoofing

MITRE ATT&CK techniques

ID	Name	Tactic
T1110	Brute Force	Credential Access
T1078	Valid Accounts	Defense Evasion

Common Weakness Enumeration

Mitigating controls

ctrl-auth-1: Implement multi-factor authentication
ctrl-auth-2: Enforce strong password policies
ctrl-auth-3: Implement account lockout mechanisms
ctrl-auth-4: Use secure session management
ctrl-auth-5: Implement rate limiting on authentication endpoints

References