SecureAEye LAB ONLINE · SIG 657 · DET ~41s

← All attacks / Web and application attacks

Broken authentication (API)

Weak API login lets stuffing, spraying or token abuse through

categoryWeb and application attacksseverityHighdetectabilityHighlabnot yet measured

Classification

31 values: 17 imported, 2 derived, 12 machine-classified. What do these mean?

Exploitability

Attack vector	Credential attacksSoftware vulnerabilities
Reach (CVSS)	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Attacker skill required	Low
Resources required	Low
Likelihood / prevalence	High
Maturity	Established

Impact & scope

Severity	High
Impact	AvailabilityConfidentialityIntegrity
Platform	ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows
Environment	Cloud
Target asset class	IdentityWeb app / API
Kill-chain phase (tactic)	Credential Access

Detection & telemetry

Detectability	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	User Account Authentication

Detection & response

Mitigated by 31

Detected by 29

DET0463 attack-detection-strategy
1883444f-084b-419b-ac62-e0d0c5b3693f sigma
218d2855-2bba-4f61-9c85-81d0ea63ac71 sigma
259a9cdf-c4dd-4fa2-b243-2269e5ab18a2 sigma
28870ae4-6a13-4616-bd1a-235a7fad7458 sigma
28ecba0a-c743-4690-ad29-9a8f6f25a6f9 sigma
2b7d6fc0-71ac-4cf7-8ed1-b5788ee5257a sigma
39b31e81-5f5f-4898-9c0e-2160cfc0f9bf sigma
42a993dd-bb3e-48c8-b372-4d6684c4106c sigma
50e606bf-04ce-4ca7-9d54-3449494bbd4b sigma
53bb4f7f-48a8-4475-ac30-5a82ddfdf6fc sigma
5496ff55-42ec-4369-81cb-00f417029e25 sigma
56fa3cd6-f8d6-4520-a8c7-607292971886 sigma
60f6535a-760f-42a9-be3f-c9a0a025906e sigma
6393e346-1977-46ef-8987-ad414a145fad sigma
70ed1d26-0050-4b38-a599-92c53d57d45a sigma
71886b70-d7b4-4dbf-acce-87d2ca135262 sigma
78d5cab4-557e-454f-9fb9-a222bd0d5edc sigma
8c944ecb-6970-4541-8496-be554b8e2846 sigma
9a60e676-26ac-44c3-814b-0c2a8b977adf sigma
9c8acf1a-cbf9-4db6-b63c-74baabe03e59 sigma
a557ffe6-ac54-43d2-ae69-158027082350 sigma
a7c0ae48-8df8-42bf-91bd-2ea57e2f9d43 sigma
aaafa146-074c-11eb-adc1-0242ac120002 sigma
b4a6d707-9430-4f5f-af68-0337f52d5c42 sigma
c42a3073-30fb-48ae-8c99-c23ada84b103 sigma
d3f90469-fb05-42ce-b67d-0fded91bbef3 sigma
e40f4962-b02b-4192-9bfe-245f7ece1f99 sigma
ebfe73c2-5bc9-4ed9-aaa8-8b54b2b4777d sigma

Tested by 22

09480053-2f98-4854-be6e-71ae5f672224 atomic
263ae743-515f-4786-ac7d-41ef3a0d4b2b atomic
4097bc00-5eeb-4d56-aaf9-287d60351d95 atomic
4852c630-87a9-409b-bb5e-5dc12c9ebcde atomic
4f08197a-2a8a-472d-9589-cd2895ef22ad atomic
59dbeb1a-79a7-4c2a-baf4-46d0f4c761c4 atomic
5a51ef57-299e-4d62-8e11-2d440df55e69 atomic
5ccf4bbd-7bf6-43fc-83ac-d9e38aff1d82 atomic
6d27df5d-69d4-4c91-bc33-5983ffe91692 atomic
90bc2e54-6c84-47a5-9439-0a2a92b4b175 atomic
9c10d16b-20b1-403a-8e67-50ef7117ed4e atomic
a790d50e-7ebf-48de-8daa-d9367e0911d4 atomic
a8aa2d3e-1c52-4016-bc73-0f8854cfa80a atomic
abcde488-e083-4ee7-bc85-a5684edd7541 atomic
b15bc9a5-a4f3-4879-9304-ea0011ace63a atomic
ba1bf0b6-f32b-4db0-b7cc-d78cacc76700 atomic
c2969434-672b-4ec8-8df0-bbb91f40e250 atomic
c6f25ec3-6475-47a9-b75d-09ac593c5ecb atomic
d546a3d9-0be5-40c7-ad82-5a7d79e1b66b atomic
ed6c2c87-bba6-4a28-ac6e-c8af3d6c2ab5 atomic
f14d956a-5b6e-4a93-847f-0c415142f07d atomic
f3a10056-0160-4785-8744-d9bd7c12dc39 atomic

Attack relationships

Child: Brute force / password guessing
Child: Credential stuffing
Child: Dictionary attack
Child: JWT weak-secret brute force
Child: Password cracking / rainbow tables
Child: Password spraying
Child: PMKID attack
Child: WPA/WPA2 handshake cracking

Framework references

Primary source: https://owasp.org/API-Security/editions/2023/en/0x11-t10/
owasp-api: API2:2023 (primary)
cwe: CWE-287
attack: T1110

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Web and application attacks' table, line 272 of Cyber-Attack-Taxonomy.md
ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to cwe:CWE-287, attack:T1110 as the nearest framework entries; ids verified to exist in the cached catalogues.
ev-0003 (MITRE Common Weakness Enumeration (CWE) 4.20) — Linked to CWE-287 'Improper Authentication', a CWE Class-level weakness (CWE 4.20).
Improper Authentication
ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 25 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)