Skip to content
Kodesec × Integrated-Systems.ai
KODESEC
Book a call

A07 · OWASP Top 10 · 3 min

Authentication failures. Is that really who they say they are?

Logging in is how your site decides who's who. This is what happens when that check is weak, guessable or easy to skip, and a stranger walks in as one of your customers or staff.

I run a

In 10 seconds

A login that cannot tell the real person from an impostor.

What it is

Your login is the front door. Failures are weak passwords allowed, unlimited guesses, no second step, and "stay logged in" tokens that are never ended or are easy to steal.

Why you care

A stranger who logs in as a customer sees their data and acts in their name. Logged in as staff, they can reach your names, addresses, phone numbers and purchase history. Most come from passwords reused from other breaches, not clever hacking.

What to do

Ask for a second step on staff and admin logins first, then limits on login attempts, then check how long sessions stay open.

For your business

What's at stake for you.

I run a

Who is affected

Your customers, and anyone who trusts you with their details.

What could leak

Names, addresses, phone numbers and purchase history.

Ask this first

“What password rules do we enforce, and do we check new passwords against known leaked ones?”

Where it hides

Pick a part of your sign-in.

The login screen is only one piece. Each of these can fail on its own.

yourbusiness.com/signup
What's here
The rules for what passwords customers and staff may use.
What goes wrong
Weak passwords like "123456" or the company name are allowed, and the same password is reused across many sites.
Ask your team
What password rules do we enforce? Do we check new passwords against lists of known leaked ones?
Developers call it
Weak password policy, breached-password screening

What it costs

A valid login looks like a real customer.

Account takeover

A stranger acts as your customer: sees their data, spends their money, changes their details.

Staff takeover

One admin login can open everything, so attackers go for staff accounts first.

Not even hacked

Most come from passwords reused from other breaches. It takes patience and stolen lists, not skill.

Hard to spot

A correct password looks normal in your logs, so takeovers can run unnoticed for a long time.

For an online shop: one taken-over staff login could expose names, addresses, phone numbers and purchase history.

Does this apply to you?

Tick what's true. Get your questions.

First

So the questions fit you

What kind of business do you run?

Real cases

Real logins, wrong people.

Old account, no second step, 2021

One forgotten login shut down a fuel pipeline.

What it cost
Colonial halted the pipeline and paid a ransom of about $4.4 million in bitcoin.
The lesson
A leaver-style account plus no second step. One password, with national consequences.
Read the full story and sources

In May 2021 ransomware attackers shut down Colonial Pipeline, which carries fuel along the US East Coast. The investigation found the way in was a VPN account that was no longer in use but still active. Its password had turned up in leaked credentials, and the account had no second step.

Colonial halted the pipeline and paid a ransom of about $4.4 million in bitcoin. Fuel shortages followed in several US states, and US authorities later recovered part of the ransom.

Sources: Colonial Pipeline CEO's testimony to the US Senate (June 2021), US Department of Justice, press coverage.

Your part

Three decisions that are yours.

  1. 01Require a second stepStart with every staff, admin and vendor login, then extend it to customers where the stakes are high.
  2. 02Set the login rulesPassword standards, limits on attempts and how long sessions last are business decisions. Approve them like any other rule.
  3. 03Own leavers and shared accountsMake removing access part of every departure, and review who has access on a regular schedule.
For your developer: the technical layer
  • Follow NIST SP 800-63B: long passphrases, allow password managers, screen new passwords against breached lists, and avoid composition gimmicks.
  • Rate-limit by account and by source, slow down repeated failures, and detect credential stuffing. Bot defences supplement this, they don't replace it.
  • Prefer phishing-resistant MFA (passkeys or security keys). Use app codes with number matching over SMS, and guard against push-prompt fatigue.
  • Sessions: random identifiers validated on the server, Secure, HttpOnly and SameSite cookies, rotation at login, invalidation on logout and password change, idle and absolute timeouts, never in URLs.
  • Return generic error messages so the login doesn't reveal which accounts exist.
  • Hash passwords with Argon2id, scrypt or bcrypt.
  • Log sign-ins, alert on anomalies, and automate offboarding through your identity provider.

Remember

Three things to keep.

  • Most account takeovers are logins that look real, usually reused passwords rather than clever hacking.
  • A second step on staff and admin accounts is the single most valuable fix.
  • People leave, accounts shouldn't linger. Make removing access part of every departure.

What OWASP says

The essentials, slide by slide.

A07 · owasp top 10 · 01/04

OWASP Top 10 · A07

authentication failures

Source: OWASP Top 10:2025 (CC BY 3.0) ↗

OWASP is a non-profit that publishes the industry's standard list of web risks. Safety measures adapted from the OWASP Top 10:2025 (CC BY 3.0). The people and businesses in the examples are made up.