{
  "id": 3447037,
  "title": "Manually Breaking Authentication — A Full Walkthrough (CWE-307, CWE-330, CWE-640)",
  "url": "https://urgent.news/2026/08/26/manually-breaking-authentication-a-full-walkthrough-cwe-307-cwe-330",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-26T06:14:15.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/jomynn/manually-breaking-authentication-a-full-walkthrough-cwe-307-cwe-330-cwe-640-305c"
  },
  "original_language": "en",
  "account": "This report delves into a manual security assessment of three authentication vulnerabilities in a deliberately vulnerable login application. The examination was conducted using only a proxy-backed browser and a network tab, without any automated scanners.\n\nThe first vulnerability, identified under CWE-307 and OWASP A07:2021, involves the lack of rate limiting, delay, or lockout mechanisms for incorrect login attempts. The test revealed that four consecutive incorrect password submissions for the admin account returned responses without any delay or additional security measures. This absence of protective measures allows an attacker to attempt unlimited login attempts, highlighting a critical weakness in the system.\n\nThe second vulnerability, marked under CWE-330 and OWASP A07:2021, stems from the use of sequential session tokens instead of randomly generated ones. This predictability enables an attacker to use previously observed session IDs to gain unauthorized access. A demonstration showed that by clearing cookies and initiating a login request with a known session ID, the attacker could access another user's account, illustrating the severe risk posed by this design flaw.\n\nThe third vulnerability, classified under CWE-640 and OWASP A07:2021, involves password-reset tokens that are not securely generated. The reset token is derived from the user's username through a deterministic function (md5(username)), making it vulnerable to offline attacks. An attacker with knowledge of a user's username can compute the reset token without interacting with the server or having access to the user's account. The evidence demonstrated that the same reset token was generated for repeated requests, further exposing the lack of token security measures.\n\nThe findings from this manual assessment underscore the critical need for a human evaluative approach in identifying authentication flaws that automated scanners often overlook. The manual review process, which relied on capturing raw HTTP traffic and analyzing it for patterns and inconsistencies, successfully uncovered these vulnerabilities that might be misidentified or missed by automated tools. This underscores the importance of integrating human expertise with automated security tools to achieve a comprehensive security assessment.",
  "summary": "A fully manual security assessment of three broken-authentication bugs — no scanners, just a proxy-backed browser and raw HTTP evidence, mapped end-to-end to CWE and OWASP. ⚠️ Educational / authorized testing only. Everything below targets a local, deliberately vulnerable training application, not a live system. Never run these techniques against anything you don't own or don't have explicit…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}