thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Identification and Authentication Failures

OWASP Top 10 category for weaknesses in confirming user identity, authentication and session management.

Definition

Includes permitting brute force and credential stuffing, weak or default passwords, weak credential recovery, plaintext or weakly hashed passwords, missing MFA, session IDs in URLs and failure to invalidate sessions. Renamed Authentication Failures in 2025. Mitigations include MFA, breached-password checks, rate limiting and secure session management.

Example

Session tokens remain valid after logout and can be reused from a shared computer.

Exam tip

Formerly Broken Authentication (2017); A07 in 2021 and 2025.

Related terms