What it asks for. This category covers weaknesses in confirming user identity and managing sessions. Examples include allowing credential stuffing and brute force attacks, permitting weak or default passwords, weak recovery processes, storing passwords insecurely, missing or ineffective multi-factor authentication, exposing session identifiers and failing to invalidate sessions on logout or after inactivity.
In practice. Applications implement multi-factor authentication, check new passwords against known breached lists, rate limit and monitor login attempts, use secure, well tested session management and store passwords with an adaptive hashing algorithm. Evidence includes authentication configuration, test results, monitoring alerts for login abuse and reviews of account recovery flows.
Common gaps. Account recovery and help desk resets are often weaker than the login itself. Multi-factor authentication may also be applied to the web interface but not to APIs or legacy protocols.