Authentication Failures
Weak, missing, or improperly implemented authentication.
What it is
Authentication Failures (renamed in 2025 from Identification and Authentication Failures, retaining the A07 slot) covers any failure to correctly verify the identity of an entity interacting with the application. Manifestations include missing authentication on critical functions, brute-forceable login flows, weak password policies, predictable session identifiers, JWT validation that decodes but does not verify, and credential stuffing surface area without monitoring. Authentication failures are the foundational weakness behind most disclosed account takeovers and an explicit control area in HIPAA, PCI-DSS, and CMMC.
Common patterns
- •Routes with no authentication middleware on sensitive paths (/admin, /internal, /debug).
- •JWT verification calls with verify:false, missing signing key, or accepting 'alg':'none'.
- •Login flows without rate limiting, account lockout, or CAPTCHA on repeated failures.
- •Password requirements that allow trivially-crackable choices ('a' or '12345').
- •Hardcoded API keys, DB passwords, or signing secrets in source.
- •Session IDs generated from predictable sources (timestamps, weak PRNG, sequential counters).
What Deva detects
Deva flags routes whose path suggests sensitivity (admin, internal, debug, dashboard) and that lack any authentication middleware in their chain. The scanner detects JWT.verify with verify:false, signing-key references that resolve to literal short strings, password comparison without constant-time helpers, and session ID generation using Math.random or other weak sources. Hardcoded credential detectors run continuously in the IDE and as a CI step.
CWE detection guides
Real-world examples
| Year | Incident | What happened |
|---|---|---|
| 2021 | Colonial Pipeline ransomware | Initial access was a leaked legacy VPN password reused from another breach. The VPN account remained active despite being unused, and 2FA was not enforced on it. The ransom payment was ultimately around 4.4 million USD. |
| 2020 | SolarWinds Orion supply chain attack | Attackers planted credentials in the build pipeline through which Orion updates were signed. Although the proximate cause was build-system compromise, the broader weakness was that build-system access was not subject to phishing-resistant authentication. |
Compliance framework impact
- •NIST 800-53 IA-2 Identification and Authentication
- •PCI-DSS v4.0 Req 8.3 Strong authentication, Req 8.4 Multi-factor authentication
- •HIPAA 164.312(d) Person or Entity Authentication, 164.308(a)(5) Security Awareness Training
- •CMMC 2.0 IA.L2-3.5.1 Identify users
Deva detects the authentication failures patterns above at write time, alongside 970+ other CWE rules, with fixes mapped to the compliance controls each finding touches.