[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:owasp\u002Ftop10-2021-a07":3},{"item":4,"lessons":16,"controls":66,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"owasp","top10-2021-a07","A07:2021","A07:2021 Identification and Authentication Failures",20,"OWASP Foundation","**What it asks for.** This category covers weaknesses in confirming user identity and managing sessions. Examples include allowing credential stuffing and brute force attacks, permitting weak or default passwords, weak recovery processes, storing passwords insecurely, missing or ineffective multi-factor authentication, exposing session identifiers and failing to invalidate sessions on logout or after inactivity.\n\n**In practice.** Applications implement multi-factor authentication, check new passwords against known breached lists, rate limit and monitor login attempts, use secure, well tested session management and store passwords with an adaptive hashing algorithm. Evidence includes authentication configuration, test results, monitoring alerts for login abuse and reviews of account recovery flows.\n\n**Common gaps.** Account recovery and help desk resets are often weaker than the login itself. Multi-factor authentication may also be applied to the web interface but not to APIs or legacy protocols.",null,"https:\u002F\u002Fowasp.org\u002FTop10\u002FA07_2021-Identification_and_Authentication_Failures\u002F","Read it at OWASP","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"critical-wordpress-plugin-flaws-demand-immediate-patching","Critical WordPress Plugin Flaws Demand Immediate Patching","2026-10-01T06:21:08.364+00:00",{"slug":23,"title":24,"published_at":25},"543000-valid-credentials-exposed-in-public-github-repos-for-over-2-years","543,000+ Valid Credentials Exposed in Public GitHub Repos for Over 2 Years","2026-09-30T20:21:00.802+00:00",{"slug":27,"title":28,"published_at":29},"mcp-python-sdk-oauth-credential-theft-via-malicious-server-redirect","MCP Python SDK OAuth Credential Theft via Malicious Server Redirect","2026-09-29T08:21:06.466+00:00",{"slug":31,"title":32,"published_at":33},"gitlab-email-token-leak-enables-unauthorized-code-commits-and-ci-bypasses","GitLab Email Token Leak Enables Unauthorized Code Commits and CI Bypasses","2026-09-23T20:22:47.654+00:00",{"slug":35,"title":36,"published_at":37},"ai-security-test-bleeds-into-live-systems-after-domain-name-collision","AI Security Test Bleeds Into Live Systems After Domain Name Collision","2026-09-19T10:20:36.682+00:00",{"slug":39,"title":40,"published_at":41},"ai-assisted-exploit-chains-libheif-flaw-with-sign-in-bug-to-breach-openai-internals","AI-Assisted Exploit Chains libheif Flaw with Sign-In Bug to Breach OpenAI Internals","2026-09-18T14:21:04.017+00:00",{"slug":43,"title":44,"published_at":45},"default-admin-key-exposes-nearly-10-of-public-litellm-ai-gateways","Default Admin Key Exposes Nearly 10% of Public LiteLLM AI Gateways","2026-09-10T10:20:35.885+00:00",{"slug":47,"title":48,"published_at":49},"stolen-ai-session-tokens-enable-mfa-bypass-via-infostealer-malware","Stolen AI Session Tokens Enable MFA Bypass via Infostealer Malware","2026-09-09T16:22:26.213+00:00",{"slug":51,"title":52,"published_at":53},"ai-models-exploit-weak-passwords-and-misconfigs-to-breach-real-organizations","AI Models Exploit Weak Passwords and Misconfigs to Breach Real Organizations","2026-09-09T16:21:03.344+00:00",{"slug":55,"title":56,"published_at":57},"miniorange-plugin-auth-bypass-exposes-wordpress-sites-to-admin-takeover","MiniOrange Plugin Auth Bypass Exposes WordPress Sites to Admin Takeover","2026-08-25T14:20:22.605+00:00",{"slug":59,"title":60,"published_at":61},"critical-wordpress-saml-plugin-flaws-enable-unauthenticated-admin-takeover","Critical WordPress SAML Plugin Flaws Enable Unauthenticated Admin Takeover","2026-08-25T10:21:10.387+00:00",{"slug":63,"title":64,"published_at":65},"miniorange-saml-plugin-auth-bypass-exposes-wordpress-admin-access","miniOrange SAML Plugin Auth Bypass Exposes WordPress Admin Access","2026-08-24T20:20:24.325+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"patch-management","Automated patch management","Known holes get closed in days, not months.",10,{"slug":73,"name":74,"problem":75,"stories":76},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",9,{"slug":78,"name":79,"problem":80,"stories":81},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",7,{"slug":83,"name":84,"problem":85,"stories":86},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",6,{"slug":88,"name":89,"problem":90,"stories":91},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",3,{"slug":93,"name":94,"problem":95,"stories":91},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[97,103,108,114,118,122,127,130],{"family":98,"item":99,"code":100,"title":101,"together":102},"cis","7","Control 7","Continuous Vulnerability Management",14,{"family":104,"item":105,"code":106,"title":107,"together":102},"gdpr","32","Article 32","Security of processing",{"family":109,"item":110,"code":111,"title":112,"together":113},"nist-800-53","si-2","SI-2","Flaw Remediation",12,{"family":98,"item":115,"code":116,"title":117,"together":76},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":109,"item":119,"code":120,"title":121,"together":76},"ia-5","IA-5","Authenticator Management",{"family":109,"item":123,"code":124,"title":125,"together":126},"ac-2","AC-2","Account Management",8,{"family":98,"item":128,"code":129,"title":125,"together":126},"5","Control 5",{"family":98,"item":131,"code":132,"title":133,"together":81},"16","Control 16","Application Software Security"]