appsec.fyi

Authentication Resources

Post Share

A curated AppSec resource library covering XSS, SQLi, SSRF, IDOR, RCE, XXE, OSINT, and more.

Authentication

Authentication is the process of verifying who a user claims to be — typically through passwords, tokens, certificates, biometrics, or hardware authenticators. It is distinct from authorization, which determines what an authenticated user is allowed to do, and the two failure modes are different: a correctly authenticated user can still be a victim of broken access control, and a perfectly authorized request can still come from a forged identity.

Modern authentication relies on layered standards: OAuth 2.0 for delegated access, OpenID Connect for federated identity, SAML for enterprise SSO, JWT for stateless session tokens, and FIDO2/WebAuthn for phishing-resistant passkeys. Each of these has well-documented attack surface — OAuth redirect_uri bypasses, SAML XML signature wrapping, MFA fatigue and AiTM phishing, session fixation, and credential stuffing remain among the most common root causes in real-world breaches.

The shift toward passkeys represents the biggest practical improvement in years: public-key credentials bound to a specific origin eliminate phishing, credential stuffing, and password reuse in one stroke. But the long tail of legacy authentication — password reset flows, OAuth implementations, SAML assertion handling, and MFA bypass paths — continues to produce critical findings across bug bounty programs.

This page collects research, writeups, tools, and standards covering authentication attacks and defenses: OAuth and SAML vulnerabilities, MFA bypass techniques, passkey rollouts, session management, and the OWASP cheat sheets that codify what good authentication looks like.

From OWASP Authentication Cheat Sheet

Date Added Link Excerpt
2026-04-10 NEW 2026Semrush OAuth redirect_uri bypass via IDN homograph — HackerOne #861940Semrush OAuth redirect_uri bypass via IDN homograph — HackerOne #861940
2026-04-10 NEW 2026Slack OAuth2 redirect_uri bypass — HackerOne #2575Slack OAuth2 redirect_uri bypass — HackerOne #2575
2026-04-10 NEW 2026Cisco Talos: State-of-the-art phishing — MFA bypassCisco Talos: State-of-the-art phishing — MFA bypass
2026-04-10 NEW 2026Bugcrowd: How attackers bypass multi-factor authentication (Part 1)Bugcrowd: How attackers bypass multi-factor authentication (Part 1)
2026-04-10 NEW 2026webauthn.me: WebAuthn and Passkeys guidewebauthn.me: WebAuthn and Passkeys guide
2026-04-10 NEW 2026FIDO Alliance: Passkeys overviewFIDO Alliance: Passkeys overview
2026-04-10 NEW 2026Hackmanit: XML Signature Validation Bypass in SimpleSAMLphp and xmlseclibsHackmanit: XML Signature Validation Bypass in SimpleSAMLphp and xmlseclibs
2026-04-10 NEW 2026epi052: How to Hunt Bugs in SAML — A Methodology (Part II)epi052: How to Hunt Bugs in SAML — A Methodology (Part II)
2026-04-10 NEW 2026IBM: What is XML Signature Wrapping?IBM: What is XML Signature Wrapping?
2026-04-10 NEW 2026USENIX: On Breaking SAML — Be Whoever You Want to BeUSENIX: On Breaking SAML — Be Whoever You Want to Be
2026-04-10 NEW 2026Astrix Security: How attackers exploit OAuth — a deep dive (Part 2)Astrix Security: How attackers exploit OAuth — a deep dive (Part 2)
2026-04-10 NEW 2026The Hacker Recipes: OAuth 2.0The Hacker Recipes: OAuth 2.0
2026-04-10 NEW 2026Security Innovation: Pentester's Guide to Evaluating OAuth 2.0Security Innovation: Pentester's Guide to Evaluating OAuth 2.0
2026-04-10 NEW 20260xn3va: OAuth 2.0 Vulnerabilities cheat sheet0xn3va: OAuth 2.0 Vulnerabilities cheat sheet
2026-04-10 NEW 2026Cobalt: OAuth Vulnerabilities Part 2Cobalt: OAuth Vulnerabilities Part 2
2026-04-10 NEW 2026Vaadata: Understanding OAuth 2.0 and its common vulnerabilitiesVaadata: Understanding OAuth 2.0 and its common vulnerabilities
2026-04-10 NEW 2026Doyensec: Common OAuth VulnerabilitiesDoyensec: Common OAuth Vulnerabilities
2026-04-10 NEW 2026OWASP WSTG: Testing for Session FixationOWASP WSTG: Testing for Session Fixation
2026-04-10 NEW 2026OWASP: Session Fixation ProtectionOWASP: Session Fixation Protection
2026-04-10 NEW 2026OWASP: Session fixation attackOWASP: Session fixation attack
2026-04-10 NEW 2026OWASP Top 10 A07: Identification and Authentication FailuresOWASP Top 10 A07: Identification and Authentication Failures
2026-04-10 NEW 2026OWASP Session Management Cheat SheetOWASP Session Management Cheat Sheet
2026-04-10 NEW 2026OWASP Authentication Cheat SheetOWASP Authentication Cheat Sheet
2026-04-10 NEW 2026The Fragile Lock: Novel Bypasses for SAML Authentication | PortSwigger ResearchThe Fragile Lock: Novel Bypasses for SAML Authentication | PortSwigger Research
2026-04-10 NEW 2026PortSwigger: OAuth 2.0 authentication vulnerabilitiesPortSwigger: OAuth 2.0 authentication vulnerabilities

Related Topics

AuthZ 38 resources Broken access control and privilege escalation flaws JWT 25 resources JWT attack techniques: alg confusion, kid injection, weak secrets API Security 35 resources REST and API-specific vulnerability patterns CSRF 66 resources Forged authenticated requests from cross-origin pages
Compare: AuthN vs AuthZ · OAuth vs SAML

Frequently Asked Questions

What is the difference between authentication and authorization?
Authentication (authn) verifies who a user is — typically through passwords, tokens, certificates, or biometrics. Authorization (authz) determines what an authenticated user is allowed to do. The two are often conflated but rely on different mechanisms and fail in different ways. A correctly authenticated user can still be a victim of broken authorization, and vice versa.
What are the most common authentication vulnerabilities?
Common authentication flaws include credential stuffing, weak password policies, missing or bypassable multi-factor authentication, predictable session tokens, password reset poisoning, OAuth redirect_uri manipulation, SAML signature wrapping, and JWT algorithm confusion. Many real-world breaches start with authentication weaknesses rather than novel exploitation.
Are passkeys actually more secure than passwords?
Yes — passkeys use public-key cryptography bound to a specific origin, which eliminates phishing, credential stuffing, and password reuse attacks. The private key never leaves the user's device. Passkeys are based on the WebAuthn and FIDO2 standards and are now supported by major browsers, operating systems, and identity providers.

Weekly AppSec Digest

Get new resources delivered every Monday.