# A07 Auth Failures

> Skills for exploiting authentication and session management vulnerabilities including JWT, OAuth, and 2FA bypass per OWASP A07:2021.

- Skill: `omkar-ukirde/a07-auth-failures` (Agent Skill, multi-file: 6 files)
- Install (CLI): `npx skillmds@latest add omkar-ukirde/a07-auth-failures`
- Raw SKILL.md: https://api.skillmd.com/api/skills/omkar-ukirde/a07-auth-failures/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: omkar-ukirde (https://skillmd.com/u/omkar-ukirde)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/omkar-ukirde/a07-auth-failures

---


# Identification and Authentication Failures (OWASP A07)

Weaknesses in authentication mechanisms and session management.

## Skills

- [JWT Attacks](references/jwt-attacks.md) - JSON Web Token exploitation
- [OAuth Attacks](references/oauth-attacks.md) - OAuth flow manipulation
- [Session Attacks](references/session-attacks.md) - Session fixation and hijacking
- [2FA Bypass](references/2fa-bypass.md) - Two-factor authentication bypass
- [Password Reset](references/password-reset-attacks.md) - Reset flow exploitation

## Quick Reference

| Attack | Target | Technique |
|--------|--------|-----------|
| JWT | Token auth | Algorithm confusion, weak secret |
| OAuth | SSO/social login | Redirect manipulation |
| Session | Cookies | Fixation, hijacking |
| 2FA | MFA | Direct access, brute force |