Issue Details
Insecure Authentication
mobile04 • Rank #4 in OWASP 2024
Explanation
Mobile authentication weaknesses include hardcoded credentials, weak password policies, insecure token storage, and missing MFA. Attackers can bypass authentication through reverse engineering, token theft, or credential stuffing. Mobile apps often maintain persistent sessions that increase exposure.
Remedy
Implement strong authentication with MFA support. Use secure token storage and short-lived sessions. Avoid hardcoding credentials or using predictable authentication patterns. Implement biometric authentication with proper fallback and account lockout policies.
| Year | Rank | Category |
|---|---|---|
| 2016 | #4 | mobile04 - Insecure Authentication |
| 2024 | #4 | mobile04 - Insecure Platform Usage and Integration |