Which OWASP Top 10 2021 category includes authentication and session flaws?

Question

Options

• AA01 - Broken Access Control
• BA02 - Cryptographic Failures
• CA07 - Identification and Authentication Failures
• DA10 - SSRF

• A
  12% (4)
• B
  6% (2)
• C
  79% (26)
• D
  3% (1)

Explanation

A07 - Identification and Authentication Failures is correct because this category specifically covers weaknesses in how applications verify who users are and maintain their sessions - including broken login mechanisms, weak passwords, credential stuffing, missing MFA, and insecure session token handling.

Why the distractors are wrong:

• A01 - Broken Access Control is about what authenticated users are allowed to do, not about verifying identity itself (authorization vs. authentication).
• A02 - Cryptographic Failures covers weak or missing encryption protecting data at rest or in transit (e.g., storing passwords in plaintext, weak TLS) - it's adjacent but distinct from auth logic flaws.
• A10 - SSRF (Server-Side Request Forgery) is an entirely different class of vulnerability where attackers trick a server into making requests to unintended internal resources.

Memory tip: Think of A07 as the "bouncer failure" category - it's when the system fails to properly check IDs at the door. The word "Identification" in the name is your direct cue that this is the authentication/session category.

No community discussion yet for this question.