{
  "node_id": "owasp-api-top-10-2023-api02-broken-authentication",
  "title": "API2:2023 Broken Authentication",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2023-06-13",
  "bluf": "OWASP API Security Top 10 (2023) API2:2023 Broken Authentication. Authentication endpoints and flows are assets that need to be protected. Additionally, \"Forgot password / reset password\" should be treated the same way as authentication mechanisms. An API is vulnerable if it: * Permits credential stuffing where the attacker uses brute force with a list of valid usernames and passwords. * Permits attackers to perform a brute force attack on the same user account, without presenting captcha/account lockout mechanism. * Permits weak passwords. * Sends sensitive authentication details, such as auth tokens and passwords in the URL. * Allows users to change their email address, current password, or do any other sensitive operations without asking for password confirmation. * Doesn't validate the authenticity of tokens. * Accepts unsigned/weakly signed JWT tokens (`{\"alg\":\"none\"}`) * Doesn't validate the JWT expiration date. * Uses plain text, non-encrypted, or weakly hashed passwords. * Uses weak encryption keys. On top of that, a microservice is vulnerable if: * Other microservices can access it without authentication * Uses weak or predictable tokens to enforce authentication This category sits within the OWASP API Security Top 10 (2023 edition), the canonical industry list of the ten most critical API security risks. Organizations implementing API services should treat each of the ten categories as both a design constraint and a continuous-monitoring obligation, with policies, automated testing, and incident response procedures defined per category.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "ai_overlay_2026"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "owasp-asvs-l1",
    "owasp-asvs-l2",
    "nist-sp-800-53-r5",
    "iso-27001-2022"
  ],
  "primary_citations_count": 12
}