Authentication Failures: OWASP Top 10 Part 7 | Ep 203

In Part 7 of our OWASP Top 10 2025 series, Brad Causey and Jordan Natter dig into A07: Authentication Failures. They explain what makes MFA real, why session management is where attackers are focusing now, and share stories from real web app and mobile banking pen tests where authentication broke down.

In this episode:

• Authentication vs. authorization, and why the difference matters
• The three MFA factors, and why a secret question is just “same factor auth”
• Password reset links that never expire and can be reused
• How a mobile banking API let testers reset MFA without finishing login
• Changing the MFA delivery email without MFA
• Sessions that survive logout and password changes
• Session fixation and predictable session tokens
• Why every change to an authentication component needs strong authentication first

Need a web app pen test? Reach out to the SecurIT360 team at https://www.securit360.com/

Work with Us: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov

Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com