A07

Authentication failures come in many shapes. The verifier doesn't rate-limit; registration accepts any password; error messages reveal who exists.

CWE-204 Response Discrepancy Information Exposure (Username Enumeration)

Login, reset, and "forgot password" forms often respond differently for valid vs invalid users. That one bit lets attackers map your entire user base.

Vulnerable code:

if u in USERS:
    return 'User exists. Wrong password.'   # different message
return 'No such user.'                       # different message

Try it yourself

Probe a known user

Submit alice. Server confirms she exists.

Probe a non-existent one

Submit nobody. Server denies it. Different bit → enumeration.

A07 – Authentication Failures

Try it yourself

Probe a known user

Probe a non-existent one