Attackers exploit weaknesses in authentication or session management to impersonate users. This vulnerability is known as?

Attackers exploit weaknesses in authentication or session management to impersonate users. This vulnerability is known as?

• A. Timeout Exploitation
• B. Broken Authentication
• C. Access Control
• D. Password Exploitation

Answer: (B)

Weaknesses in how users prove their identity and how their sessions are managed allow attackers to impersonate legitimate users. This is described as broken authentication. It covers flaws in login processes, session token handling, and session invalidation—such as using predictable session IDs, not requiring re-authentication for sensitive actions, poor password storage, or failing to revoke tokens after logout. All of these enable an attacker to masquerade as someone else. Timeout exploitation would focus on abusing session timeouts for access or denial of service, not the broader pattern of impersonation through authentication and session flaws. Access control deals with what an authenticated user is allowed to do, not the weaker authentication or session management that enables impersonation. Password exploitation targets stealing or guessing passwords specifically, whereas broken authentication encompasses a wider range of weaknesses in both authentication and session handling that lead to impersonation.

Weaknesses in how users prove their identity and how their sessions are managed allow attackers to impersonate legitimate users. This is described as broken authentication. It covers flaws in login processes, session token handling, and session invalidation—such as using predictable session IDs, not requiring re-authentication for sensitive actions, poor password storage, or failing to revoke tokens after logout. All of these enable an attacker to masquerade as someone else.

Timeout exploitation would focus on abusing session timeouts for access or denial of service, not the broader pattern of impersonation through authentication and session flaws. Access control deals with what an authenticated user is allowed to do, not the weaker authentication or session management that enables impersonation. Password exploitation targets stealing or guessing passwords specifically, whereas broken authentication encompasses a wider range of weaknesses in both authentication and session handling that lead to impersonation.