Attack scenario
Broken API authentication and token abuse
An adversary bypasses login, password recovery, or token validation and assumes the identity of a user or service.
Why this scenario matters
The scenario includes credential stuffing, brute force, weak passwords, broken JWT signature or expiry validation, predictable tokens, tokens in URLs, missing re-authentication for sensitive operations, and unauthenticated service-to-service calls.
Authentication and recovery endpoints require standard protocols, strong token validation, MFA, rate limiting, automation detection, secure secret storage, and re-authentication for risky changes.
The scenario uses MITRE ATT&CK® as a reference model. It is an expert SecTec interpretation and does not imply endorsement by MITRE.
Relevant ATT&CK tactics
- Credential Access
- Initial Access
- Lateral Movement
- Persistence
- Privilege Escalation
- Stealth
Relevant ATT&CK techniques
Reference frameworks
SecTec technologies and vendors
The following hierarchy is derived from the approved ATT&CK-to-technology and technology-to-vendor mappings.