Vulnerabilities in password-based login
Summary: PortSwigger's research explains that password-based login treats knowledge of a secret password as sufficient proof of identity, so the site is compromised if an attacker can obtain or guess another user's credentials. It details how automated brute-force attacks using wordlists, username enumeration through observable differences in login and registration responses, and predictable user password patterns such as Mypassword1! or Myp4$$w0rd make guessing more efficient than random iteration.
What you should know: Credential stuffing, which uses username:password pairs stolen in data breaches, defeats account locking because each username is only attempted once and can compromise many accounts in a single automated attack. Rate limiting that resets its failed-attempt counter when the IP owner logs in successfully can be rendered virtually useless by inserting your own credentials at intervals throughout the wordlist.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026