Which vulnerability occurs when session tokens or login mechanisms are flawed, enabling attackers to impersonate users (for example, due to weak passwords or lack of MFA)?

• A. SQL Injection
• B. Broken Authentication
• C. Cross-Site Scripting
• D. Privilege Escalation

Answer: (B)

Weak authentication and session management allow attackers to impersonate users. If the login process and session tokens are flawed—tokens that can be guessed, stolen, or not properly invalidated, or passwords that are easy to guess and MFA is absent—an attacker can prove identity as a legitimate user without proper authorization. Session tokens serve as proof of authenticated status, so their compromise or poor handling directly enables impersonation. When MFA is not used, even valid credentials can be abused if someone else learns them, making it easy to log in as the real user. This is why this vulnerability is described as broken authentication: the mechanisms meant to verify identity and maintain secure sessions are failing, allowing impersonation.

For contrast, the other issues describe different problems: SQL Injection involves manipulating a database through crafted input, Cross-Site Scripting injects malicious scripts into web pages, and Privilege Escalation is about gaining higher rights after access.