Auth Attack Wiki

How attackers forge JSON Web Tokens by abusing the alg header — the unauthenticated alg:none bypass and RS256→HS256 algorithm confusion.

HS256 JWTs signed with a guessable secret can be brute-forced offline, letting an attacker forge arbitrary valid tokens.

The kid (key id) header can be abused for path traversal, SQL injection, or command injection when the server uses it to locate the verification key.

Loose redirect_uri validation lets attackers steal OAuth authorization codes and access tokens via open redirects and host confusion.

Without a bound state parameter, OAuth flows are vulnerable to CSRF — an attacker can graft their own authorization onto a victim's session.

Modern attackers abuse the OAuth device authorization grant to phish tokens — no fake login page required. A live threat against Microsoft 365 and other IdPs.

XML Signature Wrapping abuses the gap between the element a SAML signature covers and the element the application actually reads.

Some Service Providers accept SAML assertions whose signature is merely present, absent, or unverified — allowing forged identities.

When a reset link is built from the Host or X-Forwarded-Host header, an attacker can poison it to capture a victim's reset token.

Reset tokens derived from timestamps, sequential IDs, or weak RNGs can be predicted; tokens leaked via Referer or logs enable takeover.

If an application keeps the same session id across the login boundary, an attacker can fix a victim's session and ride it post-authentication.

Stolen session cookies — via XSS, network interception, or token replay — let attackers impersonate users without a password or MFA.

Missing HttpOnly, Secure, and SameSite attributes turn ordinary bugs into session compromise and CSRF.

When a second-factor check trusts a client-supplied field or a response value, attackers flip it to skip MFA entirely.

Attackers with a valid password spam push approvals until the victim accepts one — a social-engineering bypass of push-based MFA.

Forced-browsing past the OTP step, or reusing a pre-2FA token, defeats MFA when the post-login endpoints don't re-check factor status.

Passkeys are phishing-resistant by design, but fallback flows, weak account recovery, and misconfigured relying parties reopen the door.

Attackers replay username/password pairs leaked from other breaches against your login at scale, exploiting password reuse.

Differences in responses, timing, or errors let attackers learn which usernames exist — the precursor to targeted credential attacks.

Without throttling or lockout, login and OTP endpoints can be brute-forced and stuffed at unlimited speed.