Authentication vulnerabilities
Summary: PortSwigger Research's overview of authentication vulnerabilities states that they are conceptually easy to understand but usually critical, because authentication is the process of verifying a user's identity and its flaws can let attackers reach sensitive data and functionality. It describes three main authentication types, distinguishes authentication from authorization, and notes that most authentication vulnerabilities arise in one of two ways, with impact ranging from a compromised low-privileged account to full control of an application and potential access to internal infrastructure via a high-privileged account such as a system administrator.
Key Takeaway: A single bypassed or brute-forced login hands an attacker everything the compromised account can reach, and a system administrator account can mean full control of the application and access to internal infrastructure.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026