Broken authentication is an umbrella term for several vulnerabilities that attackers exploit to impersonate legitimate users online. … Both are classified as broken authentication because attackers can use either avenue to masquerade as a user: hijacked session IDs or stolen login credentials.