Authentication mechanisms are frequently implemented incorrectly or incompletely, allowing attackers to compromise authentication tokens or to exploit implementation flaws to assume other users' identities temporarily or permanently.
Compromising a system's ability to identify the client/user compromises API security overall.
Authentication has four jobs that can each break independently:
1. Credential check — verify the password, token, or key is correct
2. Token issuance — generate a secure, unforgeable token after login
3. Token validation — verify the token on every subsequent request
4. Session management — expire, rotate, and revoke tokens properly
Break any one of these four and authentication is broken.
APIs don't have a human reviewing requests. Every call is automated. A broken auth check runs the same way whether it's a legitimate user or an attacker running a script with 10 million attempts.