[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:owasp\u002Ftop10-2021-a07":3},{"item":4,"lessons":16,"controls":67,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"owasp","top10-2021-a07","A07:2021","A07:2021 Identification and Authentication Failures",20,"OWASP Foundation","**What it asks for.** This category covers weaknesses in confirming user identity and managing sessions. Examples include allowing credential stuffing and brute force attacks, permitting weak or default passwords, weak recovery processes, storing passwords insecurely, missing or ineffective multi-factor authentication, exposing session identifiers and failing to invalidate sessions on logout or after inactivity.\n\n**In practice.** Applications implement multi-factor authentication, check new passwords against known breached lists, rate limit and monitor login attempts, use secure, well tested session management and store passwords with an adaptive hashing algorithm. Evidence includes authentication configuration, test results, monitoring alerts for login abuse and reviews of account recovery flows.\n\n**Common gaps.** Account recovery and help desk resets are often weaker than the login itself. Multi-factor authentication may also be applied to the web interface but not to APIs or legacy protocols.",null,"https:\u002F\u002Fowasp.org\u002FTop10\u002FA07_2021-Identification_and_Authentication_Failures\u002F","Read it at OWASP","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},22,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"gpustack-authentication-bypass-exploited-in-the-wild-patch-now","GPUStack Authentication Bypass Exploited in the Wild — Patch Now","2026-11-12T12:20:21.31+00:00",{"slug":24,"title":25,"published_at":26},"auth-bypass-in-xen-orchestra-lets-attackers-hijack-vm-hosts","Auth Bypass in Xen Orchestra Lets Attackers Hijack VM Hosts","2026-11-10T17:21:32.482+00:00",{"slug":28,"title":29,"published_at":30},"critical-wordpress-plugin-flaws-demand-immediate-patching","Critical WordPress Plugin Flaws Demand Immediate Patching","2026-10-01T06:21:08.364+00:00",{"slug":32,"title":33,"published_at":34},"543000-valid-credentials-exposed-in-public-github-repos-for-over-2-years","543,000+ Valid Credentials Exposed in Public GitHub Repos for Over 2 Years","2026-09-30T20:21:00.802+00:00",{"slug":36,"title":37,"published_at":38},"mcp-python-sdk-oauth-credential-theft-via-malicious-server-redirect","MCP Python SDK OAuth Credential Theft via Malicious Server Redirect","2026-09-29T08:21:06.466+00:00",{"slug":40,"title":41,"published_at":42},"gitlab-email-token-leak-enables-unauthorized-code-commits-and-ci-bypasses","GitLab Email Token Leak Enables Unauthorized Code Commits and CI Bypasses","2026-09-23T20:22:47.654+00:00",{"slug":44,"title":45,"published_at":46},"ai-security-test-bleeds-into-live-systems-after-domain-name-collision","AI Security Test Bleeds Into Live Systems After Domain Name Collision","2026-09-19T10:20:36.682+00:00",{"slug":48,"title":49,"published_at":50},"ai-assisted-exploit-chains-libheif-flaw-with-sign-in-bug-to-breach-openai-internals","AI-Assisted Exploit Chains libheif Flaw with Sign-In Bug to Breach OpenAI Internals","2026-09-18T14:21:04.017+00:00",{"slug":52,"title":53,"published_at":54},"default-admin-key-exposes-nearly-10-of-public-litellm-ai-gateways","Default Admin Key Exposes Nearly 10% of Public LiteLLM AI Gateways","2026-09-10T10:20:35.885+00:00",{"slug":56,"title":57,"published_at":58},"stolen-ai-session-tokens-enable-mfa-bypass-via-infostealer-malware","Stolen AI Session Tokens Enable MFA Bypass via Infostealer Malware","2026-09-09T16:22:26.213+00:00",{"slug":60,"title":61,"published_at":62},"ai-models-exploit-weak-passwords-and-misconfigs-to-breach-real-organizations","AI Models Exploit Weak Passwords and Misconfigs to Breach Real Organizations","2026-09-09T16:21:03.344+00:00",{"slug":64,"title":65,"published_at":66},"miniorange-plugin-auth-bypass-exposes-wordpress-sites-to-admin-takeover","MiniOrange Plugin Auth Bypass Exposes WordPress Sites to Admin Takeover","2026-08-25T14:20:22.605+00:00",[68,73,78,82,87,92],{"slug":69,"name":70,"problem":71,"stories":72},"patch-management","Automated patch management","Known holes get closed in days, not months.",12,{"slug":74,"name":75,"problem":76,"stories":77},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",9,{"slug":79,"name":80,"problem":81,"stories":77},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":83,"name":84,"problem":85,"stories":86},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",6,{"slug":88,"name":89,"problem":90,"stories":91},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",4,{"slug":93,"name":94,"problem":95,"stories":96},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",3,[98,104,110,115,119,123,128,131],{"family":99,"item":100,"code":101,"title":102,"together":103},"cis","7","Control 7","Continuous Vulnerability Management",16,{"family":105,"item":106,"code":107,"title":108,"together":109},"gdpr","32","Article 32","Security of processing",14,{"family":111,"item":112,"code":113,"title":114,"together":109},"nist-800-53","si-2","SI-2","Flaw Remediation",{"family":99,"item":116,"code":117,"title":118,"together":77},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":111,"item":120,"code":121,"title":122,"together":77},"ia-5","IA-5","Authenticator Management",{"family":111,"item":124,"code":125,"title":126,"together":127},"ac-2","AC-2","Account Management",8,{"family":99,"item":129,"code":130,"title":126,"together":127},"5","Control 5",{"family":132,"item":133,"code":134,"title":134,"together":135},"itil","overview","ITIL",7]