Scanners confirm authentication flaws that show up as a repeatable difference in responses: session IDs that do not change, different messages for real and fake users, missing lockout, vendor default logins. Flaws in business logic, such as recovery flows, MFA bypass and weak policy intent, need a person who understands the design.
Why the split exists
Authentication flaws fall into two groups. Some leave a measurable signature in HTTP traffic. A tool can compare two responses, count attempts or inspect a cookie. Others depend on what the system is supposed to do. A tool cannot tell whether a reset link should expire in ten minutes or two days, because that is a decision about your product.
OWASP's A07:2025 Authentication Failures entry describes the weakness as an application being tricked into treating an invalid user as legitimate. It names permitting automated attacks such as credential stuffing, and password spraying with variations of leaked credentials, among its causes. Several of those need judgment as well as probing.
Sorted by who finds it
| Flaw | Scanner confirms? | Why |
|---|---|---|
| Session ID unchanged after login | Usually yes | Compare cookie before and after. See session fixation |
| Account enumeration on login | Usually yes | Compare responses for real and fake users. See account enumeration |
| No lockout or throttling | Often | Send repeated failures, watch for a block, but tools limit attempts on purpose |
| Vendor default credentials | Often | Try a short list on known software. See default credentials |
| Verbose authentication errors | Yes | Inspect response text |
| Missing cookie flags and long expiry | Yes | Read headers and cookie attributes |
| Time based enumeration | Sometimes | Needs careful repeated timing |
| Weak password policy | Partly | Can try creating accounts with weak passwords, but cannot judge your risk appetite |
| Account recovery logic flaws | Rarely | Needs understanding of the full flow |
| MFA bypass and fallback weaknesses | Rarely | Depends on design and device behavior |
| Organization default passwords | No | The OWASP guide says these are hard to find from a black box view |
| Credential stuffing resilience | Partly | A test can check controls exist, not whether real leaked lists would succeed |
What humans add
- Reading the flow end to end. Registration, login, reset, email change and unlock all have to agree. The OWASP Forgot Password Cheat Sheet says tokens must be random, long enough, stored securely, single use and expiring, and that the account should not change until a valid token is presented. A scanner can check a few of those mechanics, but a reviewer judges the whole path.
- Thinking like an abuser. Locking accounts on purpose, flooding reset emails or abusing an unlock link are design questions.
- Testing every entry point. The OWASP testing guide says to repeat lockout checks on every function that needs it, including mobile and API endpoints. People notice endpoints a crawl missed.
- Judging policy. What is a reasonable lockout threshold, session length or password rule for your users?
A practical split of the work
- Run an authenticated scan with at least two test accounts for the mechanical checks above.
- Review the scan's list of tested login and reset URLs, and add any missing ones by hand.
- Have a developer or tester walk the recovery and MFA flows against a written requirement.
- Check the code or configuration for how passwords are stored and tokens generated. See storing passwords with Argon2id.
- Retest after fixes and record the evidence.
Quick check
Can a scanner prove my login is secure?
No. It can show specific weaknesses are present, and a clean result covers only what it tested. Recovery logic and MFA design need review.
Which one check should every team automate?
Session ID renewal at login and generic login responses. Both are cheap to test and easy to regress.
Try it yourself
Click through it at your own pace, or open it full screen. Check how scan results separate what was tested from what was found.
Safeguard offers a free scan at gold.safeguard.sh/scan for the identity libraries your app uses.
Sources
- OWASP Top 10 2025: A07 Authentication Failures
- OWASP WSTG: Weak Lock Out Mechanism
- OWASP WSTG: Default Credentials
- OWASP Forgot Password Cheat Sheet
Last reviewed: 19 October 2026.
