⚠ Sandboxed environment — This is an intentionally vulnerable application running inside an isolated Docker container with fake data. Nothing you do here can harm the host machine or other users.

A07 – Authentication Failures

OWASP A07:2025 CWE-307 CWE-521 CWE-204

Authentication failures come in many shapes. The verifier doesn't rate-limit; registration accepts any password; error messages reveal who exists.

CWE-307 No Lockout CWE-521 Weak Passwords CWE-204 User Enumeration
CWE-521 Weak Password Requirements

Registration with no policy. Length 1 is accepted; the empty string is accepted; every breached password from haveibeenpwned is accepted.

Vulnerable code:
USERS[u] = md5(p)   # no length, no complexity, no breach-list check

Try it yourself

Try a weak password

Use a, password, or even an empty string.

Note the warning

The page reports the length; the server treats it as fine.