⚠ Sandboxed environment — This is an intentionally vulnerable application running inside an isolated Docker container with fake data. Nothing you do here can harm the host machine or other users.

A07 – Authentication Failures

OWASP A07:2025 CWE-307 CWE-521 CWE-204

Authentication failures come in many shapes. The verifier doesn't rate-limit; registration accepts any password; error messages reveal who exists.

CWE-307 No Lockout CWE-521 Weak Passwords CWE-204 User Enumeration
CWE-307 Improper Restriction of Excessive Authentication Attempts

No lockout means the verifier's rate matches the attacker's HTTP throughput. Common-password lists land in seconds.

Vulnerable code: 
if USERS.get(u) == md5(p):
    return 'ok'
ATTEMPTS[u] += 1   # counted but never enforced

Try it yourself

Brute-force admin

Try password, 123456, admin — nothing stops you.

Watch the counter

Attempt counts climb forever. Real apps lock after 5 failures.

Failed attempts on admin: 1