> For the complete documentation index, see [llms.txt](https://ahmed-tarek.gitbook.io/security-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a07-authentication-failures.md).

# A07 Authentication Failures

- [JWT Hacking](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a07-authentication-failures/jwt-hacking.md)
- [Hardcoded & Default Credentials](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a07-authentication-failures/hardcoded-and-default-credentials.md): CWE-258, CWE-259, CWE-259, CWE-798, CWE-1392, CWE-1393
- [Authentication Bypass](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a07-authentication-failures/authentication-bypass.md): CWE-288, CWE-289, CWE-290, CWE-302, CWE-305
- [Certificate Validation Failures](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a07-authentication-failures/certificate-validation-failures.md): CWE-295, CWE-297, CWE-298, CWE-299, CWE-346:
- [Session Security](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a07-authentication-failures/session-security.md): CWE-384,  CWE-613, CWE-620, CWE-304, CWE-306
- [Dictionary Attacks and Recovery Exploits](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a07-authentication-failures/dictionary-attacks-and-recovery-exploits.md): CWE-307, CWE-521, CWE-640, CWE-1391, CWE-294
- [Network-Based Authentication Flaws](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a07-authentication-failures/network-based-authentication-flaws.md): CWE-291, CWE-293, CWE-300, CWE-350, CWE-940, CWE-941