Automated testing of username/password pairs leaked from other breaches. Works because people reuse passwords. No guessing needed — the list comes from someone else's breach.

Trying millions of password guesses on a login endpoint that has no rate limit, no lockout, and no CAPTCHA. APIs make this trivially scriptable.

JWT tokens accepted without verifying the signature, or accepting {"alg":"none"}, or tokens that never expire. An attacker can craft or modify a token and the API won't catch it.

Auth tokens passed as URL query parameters leak into server logs, browser history, proxy caches, and referrer headers. Once logged, they persist far longer than the intended session.

Sensitive operations — changing email, disabling MFA, updating payment info — don't require the current password. A stolen session token is enough to take full control.