Security Test: Leaking authentication¶

Description¶

Default Severity: medium

When a server gives out too much detail about how it handles authentication, it can tip off attackers about the inner workings of your system. Essentially, the vulnerability happens when error messages or responses include sensitive details—like which part of the authentication failed or what user information exists—making it much easier for someone with bad intentions to figure out how to bypass security checks. If left unchecked, this can lead to unauthorized access to accounts or even control over the system. The common misstep is not sanitizing the responses or revealing internal error details that could help an attacker piece together how the authentication process works.

Configuration¶

Identifier: information_disclosure/leaking_authentication

Examples¶

All configuration available:

checks:
  information_disclosure/leaking_authentication:
    skip: false # default

Compliance and Standards¶