Insecure Authentication / Authorization

Sessions that never expire or use predictable tokens, bypassable biometrics, weak password policy, client-side-only authorization, JWT alg:none / weak secrets, and OAuth implicit-flow token leakage.

27 vulnerabilities. OWASP Mobile: M3

Vulnerability	ID	Platform	Difficulty	OWASP	MASVS	MASWE	MASTG (v2)	CWE
Developer Backdoor	`developer_backdoor`	AndroidiOS	EASY	M3	MASVS-AUTH-1 MASVS-CODE-2	MASWE-0018	-	CWE-798 CWE-489 CWE-912
Username Enumeration	`username_enumeration`	AndroidiOS	EASY	M3	MASVS-AUTH-1	MASWE-0018	-	CWE-204 CWE-203
Weak / No Password Policy	`weak_password_policy`	AndroidiOS	EASY	M3	MASVS-AUTH-1	MASWE-0018	-	CWE-521
Client-Side-Only Authorization	`client_side_only_authorization`	AndroidiOS	MEDIUM	M3	MASVS-AUTH-3	MASWE-0018	-	CWE-602 CWE-639
Cross-App OTP / Credential Leak	`cross_app_otp_credential_leak`	AndroidiOS	MEDIUM	M3	MASVS-PLATFORM-1 MASVS-AUTH-2 MASVS-STORAGE-2	MASWE-0018	MASTG-TEST-0366 MASTG-TEST-0364 MASTG-TEST-0374	CWE-926 CWE-200 CWE-927
Deep Link Authentication Bypass	`deeplink_authentication_bypass`	AndroidiOS	MEDIUM	M3	MASVS-AUTH-1 MASVS-PLATFORM-1	MASWE-0018 MASWE-0029	MASTG-TEST-0371 MASTG-TEST-0370	CWE-288 CWE-306 CWE-939
Insecure / Bypassable Biometric Prompt	`insecure_biometric_prompt`	AndroidiOS	MEDIUM	M3	MASVS-AUTH-2	MASWE-0020	MASTG-TEST-0327 MASTG-TEST-0266 MASTG-TEST-0267 MASTG-TEST-0329	CWE-287 CWE-603
Insecure Credential Manager / Autofill Integration	`insecure_credential_manager`	AndroidiOS	MEDIUM	M3	MASVS-AUTH-2 MASVS-STORAGE-2 MASVS-PLATFORM-3	MASWE-0019	MASTG-TEST-0393 MASTG-TEST-0313 MASTG-TEST-0316	CWE-522 CWE-524
Insecure Password Reset Token / Magic Link	`insecure_password_reset_token`	AndroidiOS	MEDIUM	M3	MASVS-AUTH-1 MASVS-CRYPTO-1	MASWE-0012	-	CWE-640 CWE-330
JWT Vulnerabilities (alg:none, weak secret)	`jwt_vulnerabilities`	AndroidiOS	MEDIUM	M3	MASVS-AUTH-2	MASWE-0020	-	CWE-347 CWE-345
Multi-Account Isolation Failure	`multi_account_isolation_failure`	AndroidiOS	MEDIUM	M3	MASVS-AUTH-1 MASVS-STORAGE-1	MASWE-0024	-	CWE-459 CWE-200 CWE-613
Passkey Credential Exfiltration	`passkey_credential_exfiltration`	AndroidiOS	MEDIUM	M3	MASVS-AUTH-2 MASVS-STORAGE-1 MASVS-CRYPTO-2	MASWE-0003	MASTG-TEST-0287 MASTG-TEST-0301 MASTG-TEST-0302	CWE-522 CWE-312
Passkey Registration/Deletion Authorization Missing	`passkey_credential_management_authz`	AndroidiOS	MEDIUM	M3	MASVS-AUTH-1 MASVS-AUTH-2	MASWE-0020	-	CWE-862 CWE-639
Passkey Fallback / Downgrade Attack	`passkey_fallback_downgrade`	AndroidiOS	MEDIUM	M3	MASVS-AUTH-1 MASVS-AUTH-2	MASWE-0021	-	CWE-757 CWE-287
Session Fixation After WebAuthn Assertion	`passkey_session_fixation`	AndroidiOS	MEDIUM	M3	MASVS-AUTH-3 MASVS-AUTH-2	MASWE-0024	-	CWE-384
Passkey Weak / No Attestation Verification	`passkey_weak_attestation`	AndroidiOS	MEDIUM	M3	MASVS-AUTH-2	MASWE-0020	-	CWE-345 CWE-347
Weak Session Management	`weak_session_management`	AndroidiOS	MEDIUM	M3	MASVS-AUTH-1 MASVS-AUTH-2	MASWE-0024	-	CWE-613 CWE-330
Biometric Result Not Bound to Operation	`biometric_authorization_not_bound`	AndroidiOS	HARD	M3	MASVS-AUTH-2 MASVS-AUTH-1	MASWE-0020	MASTG-TEST-0327 MASTG-TEST-0266 MASTG-TEST-0267	CWE-287 CWE-1021 CWE-306
Credential Provider Release Authorization Failure	`credential_provider_release_authorization`	AndroidiOS	HARD	M3	MASVS-AUTH-2 MASVS-AUTH-1	MASWE-0018	-	CWE-863 CWE-284 CWE-346
Identity Credential / mDL Presentation Not Bound	`identity_credential_presentation_binding`	AndroidiOS	HARD	M3	MASVS-AUTH-2 MASVS-AUTH-3	MASWE-0020	-	CWE-345 CWE-384 CWE-290
OAuth Misconfiguration (implicit flow token leakage)	`oauth_misconfiguration`	AndroidiOS	HARD	M3	MASVS-AUTH-1	MASWE-0018	-	CWE-598 CWE-200
Passkey Assertion Replay (Sign-Count Not Enforced)	`passkey_assertion_replay_signcount`	AndroidiOS	HARD	M3	MASVS-AUTH-2	MASWE-0020	-	CWE-294 CWE-304
Passkey Challenge Reuse / Not Bound	`passkey_challenge_reuse`	AndroidiOS	HARD	M3	MASVS-AUTH-2	MASWE-0020	-	CWE-294 CWE-330 CWE-287
Passkey Origin / RP-ID Binding Bypass	`passkey_origin_binding_bypass`	AndroidiOS	HARD	M3	MASVS-AUTH-2 MASVS-PLATFORM-1	MASWE-0020	-	CWE-346 CWE-287
Passkey Step-Up Authentication Bypass	`passkey_stepup_auth_bypass`	AndroidiOS	HARD	M3	MASVS-AUTH-1 MASVS-AUTH-2	MASWE-0023	-	CWE-287 CWE-863
Third-Party Authenticator / Cross-Device Pairing Authorization Missing	`passkey_thirdparty_pairing_authz`	AndroidiOS	HARD	M3	MASVS-AUTH-2 MASVS-PLATFORM-1	MASWE-0020	-	CWE-862 CWE-306
Passkey User-Verification (UV) Enforcement Bypass	`passkey_user_verification_bypass`	AndroidiOS	HARD	M3	MASVS-AUTH-2	MASWE-0020	-	CWE-287 CWE-306